The most effective cybersecurity steps for a small business are simple: turn on two-factor authentication, use a password manager, keep software updated, back up your data where ransomware cannot reach it, and train staff to spot phishing and payment fraud. None of these needs a big budget. Together they stop most of the attacks that small businesses in Africa actually face.
This guide turns those basics into a practical checklist, with notes on the threats that are common locally, such as invoice fraud and WhatsApp account takeovers.
Why small businesses are targets
Many owners assume attackers only go after banks and large companies. In practice, most attacks are automated or opportunistic. Criminals send phishing emails to thousands of addresses, scan the internet for outdated websites and try leaked passwords against email accounts. A small business with weak defences is easier to break into than a large one with a security team.
The damage can be serious: money sent to a fraudster’s account, customer data exposed, a website defaced or blacklisted, or files locked by ransomware. There are legal duties too. In Zimbabwe, the Cyber and Data Protection Act requires organisations that handle personal information to protect it.
1. Secure your accounts
Turn on two-factor authentication (2FA)
2FA asks for a second proof, usually a code from an app, when someone logs in. A stolen password alone is then not enough. Turn it on first for:
- Business email accounts, especially the owner’s and finance staff’s.
- Online banking and mobile money business accounts.
- Your domain registrar and hosting control panel.
- Social media and WhatsApp Business. In WhatsApp, enable two-step verification with a PIN.
An authenticator app is safer than SMS codes, because SMS can be intercepted through SIM swap fraud.
Use a password manager
Every account should have a long, unique password. Nobody can remember dozens of these, so use a password manager. Never reuse your email password anywhere else. If one website leaks it, attackers will try it on your email.
Remove access when people leave
When a staff member or contractor leaves, change shared passwords and remove their access the same day.
2. Stop phishing and payment fraud
Most attacks start with a message that tricks someone into clicking, logging in or paying. Teach staff these rules:
- Check the sender’s actual address, not just the display name.
- Do not log in from a link in an email. Type the website address yourself.
- Verify any change of bank details by phone, using a number you already have, not one in the email. Invoice fraud, where a supplier’s email is copied or hacked and new account details are sent, is one of the most costly scams for small businesses.
- Be suspicious of urgency. “Pay today or the account closes” and “The director needs this transfer now” are classic pressure tactics.
- Never share one-time codes, including mobile money PINs or WhatsApp verification codes, with anyone who calls or messages.
Short, regular reminders work better than one long training session.
3. Protect your email domain
Use business email on your own domain, not free personal accounts, and make sure SPF, DKIM and DMARC records are set up. These DNS records tell receiving mail servers which servers may send email for your domain. They make it harder for criminals to send fake emails that look like they come from you, and they help your real emails avoid spam folders. Spam and virus filtering should be on for every mailbox.
4. Keep everything updated
- Turn on automatic updates for Windows, macOS, phones and browsers.
- Replace computers and phones that no longer receive security updates.
- If you run WordPress, keep the core, themes and plugins updated, and delete plugins you do not use. Outdated plugins are a common way websites get hacked.
- Install reputable antivirus or endpoint protection on every business computer.
5. Back up properly
Backups are what let you recover from ransomware, a stolen laptop or a hacked website. Follow these rules:
- Back up automatically, at least daily for important data.
- Keep at least one copy off-site and separate from your network, so ransomware cannot encrypt it too.
- Test a restore every few months. A backup you have never restored is a hope, not a plan.
- Back up your website separately from your host’s backups if the site is important to your business.
6. Protect your website
- Use SSL on every page so the site loads over HTTPS.
- Put the site behind a web application firewall and DDoS protection, such as Cloudflare.
- Use strong passwords and 2FA for website admin logins, and limit login attempts.
- Scan for malware regularly, so a hack is found before Google flags the site.
7. Secure your network and devices
- Change default passwords on routers and Wi-Fi equipment.
- Use a separate guest Wi-Fi network for visitors.
- Encrypt laptops so a stolen device does not mean stolen data.
- Give staff only the access their role needs.
8. Have a plan for when something goes wrong
Write down, on one page, who to call if an account is hacked, a payment is diverted or the website is defaced. Include your bank’s fraud line, your IT or hosting provider, and how to reset key passwords. Acting in the first hour often limits the damage.
Where Tremhost can help
- Business email with spam and virus filtering, 2FA, and SPF, DKIM and DMARC set up for you, from $5 a month for 50 mailboxes.
- ESET endpoint security for business computers.
- Tremhost Armor, Cloudflare protection configured and monitored by Tremhost. Armor Guard (Cloudflare Pro) is $9 a month for one site, and a free 15-day trial needs no card.
- Managed cyber security from $200 a month, for businesses that want a team to run the firewall, malware removal, email filtering and antivirus for them.
- Armor SOS: free same-day triage if your website has been hacked.
Frequently asked questions
What is the single most important step?
Turn on two-factor authentication for business email. Email is the key to resetting almost every other account.
Is free antivirus enough for a business?
It is better than nothing, but business endpoint protection adds central management, so you can see which computers are protected and up to date.
How often should a small business back up?
Daily for files and databases that change, with at least one copy kept off-site and tested regularly.
What should I do if a staff member clicked a phishing link?
Change the password for any account they entered details into, turn on 2FA if it was off, scan the device, and check for new email forwarding rules or unusual logins.
Next step
If you want security handled for you, compare the plans on the Tremhost managed cyber security page, or ask on WhatsApp (+263 73 563 9917), Monday to Friday, 08:00 to 17:00 CAT.
