What Security Checks Should a Small Business Do Every Month?

By Bill Stilwell · Last reviewed October 18, 2026

The short answer

A security and backup procedure is a short monthly routine. Review who has access to every account and remove anyone who shouldn’t. Make sure software, devices, and your website are updated. Look at security alerts and unusual activity. Confirm backups ran. And write down exactly who to call and what to do if you think something was hacked. Backups themselves are covered in 11.8 Business Backups.

Why it matters

Small businesses get hacked because they’re easy, not because they’re special. A roofing company’s old web designer still has admin access to the website, and an outdated plugin lets spammers in. A front desk worker left a year ago but still has the login to the booking system. A monthly 20-minute check closes most of these doors.

22.8.1 Access

What it means: review users and permissions.

How to do it: each month, open your access inventory (see 11.7.5 Access Inventory) and check every key account: email, website, domain, Google Business Profile, Bing Places, Apple Business Connect, social media, bank, payment processor, and customer relationship management (CRM) system. Remove anyone who no longer needs access. Lower permissions that are higher than needed (see 11.7.6 Least Privilege Access). Confirm multi-factor authentication (MFA) is on for every account that offers it.

Common mistake: forgetting outside vendors, like an old marketing agency that’s still a manager on your profile.

22.8.2 Updates

What it means: install updates for software, devices, and your website.

How to do it: turn on automatic updates for computers, phones, browsers, and apps. The Federal Trade Commission (FTC) recommends keeping software current, ideally with automatic updates. Check your website platform, themes, and plugins monthly, or confirm your web host or developer does it (see 13.2.7 Website Security Updates).

Common mistake: postponing website updates for months because “the site works fine.”

22.8.3 Monitoring

What it means: review security alerts and unusual activity.

How to do it: check for login alerts from Google, Microsoft, your bank, and other accounts. Look for password reset emails you didn’t request, new forwarding rules in email, and unexpected changes to your listings. Check the Security Issues report in Google Search Console for your website.

Common mistake: filtering security alerts into a folder nobody reads.

22.8.6 Incident

What it means: escalate a suspected compromise right away.

How to do it: write down who to call first, such as your IT person, web developer, or the account’s support line. Then follow the right response: 11.9.2 Account Takeover for a hijacked account, 11.9.4 Data Breach Response if customer data may be exposed, and 11.9.5 Payment Fraud for money. Change passwords from a clean device, and record what happened and when. If Google flags your site as hacked, fix the cause, then request a review in Search Console.

Common mistake: trying to quietly fix it alone and waiting days before calling for help.

A monthly checklist

Review users on every key account and remove old ones
Confirm MFA is on
Confirm updates are running on devices and the website
Check security alerts, email forwarding rules, and listing changes
Confirm last month’s backups ran (see 11.8 Business Backups)
Note the date and anything you fixed

When to get help from a pro

An information technology (IT) or security professional can set up monitoring and handle an incident. Questions to ask:

Which of my accounts are the highest risk if someone breaks in?
Can you set up alerts for logins and changes on my key accounts?
What should I do in the first hour if I think we’ve been hacked?

Bill’s note

[Bill: add a short note. For example, a business that lost control of its Google Business Profile or website because an old vendor still had access, and how it was recovered.] If you’d rather have this done for you, SiteSmarty handles Google Business Profile management and website care, including access reviews.

How I did this for SiteSmarty

[Date I did this:]
[What I actually did, step by step: my monthly security check for SiteSmarty accounts and the website]
[What it cost and how long it took:]
[What surprised me or what I’d do differently:]
[Screenshot or photo to add, with private info blurred: the access review and the profile’s people and access screen]
[Result so far:]

Questions people ask

How often should I review who has access? Monthly, and right away when someone leaves (see 11.7.7 Removing Access When People Leave).

Should updates be automatic? For devices, browsers, and apps, yes. For your website, have a person check that updates ran and the site still works.

Can a hacked website hurt how I show up on Google? Yes. Google may warn searchers that the site may be hacked until you fix it and request a review.

What do I do first if I think I’ve been hacked? Call the person on your incident list, change passwords from a clean device, and follow the matching response page in 11.9.

Audit check

Outline line	Question	Pass looks like	Fail looks like	Evidence to collect
22.8.1 Access	Are users and permissions reviewed monthly on every key account?	Dated review, old users removed, MFA on	Former staff or vendors still listed	Access inventory with review dates
22.8.2 Updates	Are devices, apps, and the website kept updated?	Automatic updates and monthly site check	Months-old updates	Update settings and site report
22.8.3 Monitoring	Are alerts and unusual activity reviewed?	Alerts read, Search Console checked	Alerts ignored	Monthly checklist
22.8.6 Incident	Is there a written escalation plan?	Contacts and steps written	No plan	Incident plan doc

Where this fits

Do this first: 11.7.5 Access Inventory, 11.7.3 Multi-Factor Authentication, 11.8 Business Backups

Do this next: 22.9 Emergency Procedures

Sources

Federal Trade Commission, "Cybersecurity Basics" for small business (checked October 18, 2026)
Google Search Help, "This site may be hacked" (checked October 18, 2026)

This page explains general rules and Bill's own experience. It is not legal, tax, or insurance advice. Talk to a qualified professional about your situation.