Online security tips for small business owners
Email scams are common because they work. They cast a wide net, are easy to implement, and they exploit common fears like missing a domain expiration date or receiving a warning of a fraudulent charge. These emails usually include real logos, brand colors, and even the required unsubscribe footers that appear to link to a corporate headquarters. If you’ve ever hesitated over an email or felt uncertain about a renewal notice, trust your instincts.
When scams succeed, the damage is real:
- You could lose access to your website
- Your domain could be transferred without your knowledge
- Financial information could be stolen
- Your email could be compromised, enabling further fraud
If you’re not certain where your domain is registered or which services renew when, don’t panic. A little organization and an audit of your online security habits will help protect you from most threats. I’ll show you how to recognize the patterns and verify what’s real.
Phishing emails and texts: the most common threat
You’re likely inured to the well-known Nigerian Prince email requesting advance funds in exchange for a reward – but that just means scammers have become more sophisticated. Phishing emails trick you into revealing sensitive information or making fraudulent payments by impersonating real companies you do business with:
- Domain registrars (GoDaddy, Namecheap, Google Domains)
- Hosting providers (Bluehost, SiteGround, WP Engine)
- Email services (Google Workspace, Microsoft 365)
- Banks and payment processors
Recognize the tells
- Manufactured urgency – “Your account will be suspended in 24 hours” or “Immediate action required” are classic pressure tactics.
- Mismatched sender addresses – The display name says “GoDaddy Support” but the email comes from
[email protected]. Notice the missing “d”? That’s intentional. - Suspicious links – Hover over any link without clicking. If it doesn’t go to the official domain (like
godaddy.com), it’s fake. Watch for variations likegodaddy-renew-support.comorgodaddy.secure-login.net. - Poor quality control – Legitimate companies proofread. Scammers often don’t. Look for odd spacing, grammatical errors, or inconsistent branding.
- Unexpected attachments – Real service providers rarely require you to download files to verify your account.
Recognize and avoid phishing attempts, via Consumer.FTC.gov.
How to verify a suspicious email
- Check the full sender address — not just the display name
- Hover (don’t click!) over links — see where they actually go before clicking
- Log in manually — open a new browser tab and go directly to the official website
- Compare with previous emails — search your inbox for legitimate messages from that company
- Ask someone — your web designer, IT person, or a tech-savvy colleague
What NOT to do:
- Don’t click links in suspicious emails
- Don’t reply to the message
- Don’t call phone numbers listed in the email
- Don’t download attachments
- Don’t enter passwords or payment information from an email link
If you aren’t sure, STOP. Verify through official channels.
Timing matters: holiday email scams
Scammers know when you’re distracted. Phishing attempts spike around major holidays -Thanksgiving, Christmas, New Year’s – when business owners are juggling personal commitments and may not scrutinize emails as carefully. They’re also aware of business cycles: end-of-quarter deadlines, tax season, and the chaos of Q4.
An “urgent domain renewal” email that arrives December 23rd isn’t coincidence. Someone is betting you’ll click quickly to clear your inbox before heading out for the holidays. During busy periods, be extra skeptical of anything demanding immediate action.
Fake domain renewal notices (including physical mail)
Phishing doesn’t stop at your inbox. Scammers still use postal mail, and these letters can be remarkably convincing. I’ve received official-looking notices with urgent language like “Final Notice” and “Domain Expiration Warning,” complete with professional formatting and what appears to be an invoice.
These letters are designed to look like legitimate renewal notices. But read the fine print. Often they are authorizing a domain transfer, not a renewal. Pay their “invoice” and you’ve just agreed to move your domain to their registrar, often at inflated prices with auto-renewal you can’t easily cancel.
How to protect your website and your business from fake renewal scams
- Know your registrar Where is your domain actually registered? GoDaddy? Namecheap? Squarespace? If you’re not sure, look it up at ICANN’s domain lookup tool.
- Log in directly Don’t trust renewal dates in emails or letters. Sign into your actual registrar account and check there.
- Ignore unfamiliar companies If you’ve never heard of them, you don’t do business with them.
- Enable auto-renewal Most registrars offer this. It prevents your domain from accidentally expiring while eliminating the pressure tactics scammers rely on.
Copyright infringement scams
This phishing tactic targets website owners with fake copyright infringement claims. These emails claim you’ve used an image without permission and demand immediate payment or proof of licensing.
A client received an official-looking email from “COPYTRACK” alleging unauthorized use of an image on their website. The email stated the image belonged to a photographer (with a legitimate-sounding name) and demanded proof of license or a settlement payment. Luckily, they recognized it as a phishing attempt.
The email may include:
- Professional formatting and legal language
- Specific image filenames or URLs from your actual website
- A deadline creating pressure
- Settlement amounts ranging from hundreds to thousands of dollars
Many business owners can’t immediately recall the source of every image on their website, especially if someone else built the site or if it’s been around for years.
How to verify copyright claims
Real copyright enforcement happens, but scammers imitate the process. Here’s how to tell the difference:
- Don’t panic or pay immediately — legitimate copyright claims follow a formal legal process, not email demands with tight deadlines
- Research the company — search for “[company name] + scam” to see if others have reported it
- Verify the image claim — use reverse image search (Google Images) to check the image’s actual source and licensing
- Check your image sources — if you purchased the image from a stock photo site, locate your receipt or download history
- Consult a lawyer — if you believe the claim might be legitimate, speak with an attorney before responding or paying anything
Red flags for fake copyright claims
- Demands for immediate payment via email
- Threats of lawsuits with unrealistic timelines
- Requests to pay directly to individuals rather than through legal processes
- No official legal letterhead or case numbers
- Pressure to settle before “lawyers get involved”
If you receive a copyright claim and aren’t certain about your image licensing, reach out to your web designer or the person who built your site. They should be able to help you trace where images came from and whether you have proper licensing.
Security best practices
Keep records organized
Maintain a simple document (offline) or password manager entry with:
- Domain registrar name and login
- Hosting provider and login
- Email/workspace provider
- Renewal dates for each service
- Official support contact information
Important: If you’re keeping this information in a document (rather than a password manager), store it offline. Keep it in a physical notebook, a printed document in a secure location, or on an external drive that’s not connected to your computer. If your computer is compromised, any document saved on it, including password lists, can be accessed by attackers.
Using a password manager is absolutely critical these days (see FAQ below). It includes end-to-end encryption and storage in an encrypted data vault. Only YOU have the master password to this vault, which acts as your decrypt key. This is not stored anywhere. Password managers also notify you of data breaches and allow you to bulk change login details. Saving passwords to your browser does not secure your password and should be avoided.
Use multi-factor authentication
You may think this is a pain to do. Yes, it is another step – but it’s the lesser evil here. What’s worse: a teeny, tiny extra step to secure your access or dealing with ransomware that has hijacked your entire device? Enable 2FA for domain registrar, hosting, and email accounts. Even if someone gets your password, they can’t access your account without the second factor. Most services support authenticator apps like Google Authenticator, Authy, or the built-in authenticators in password managers like 1Password and Bitwarden.
Back it up!
Backups aren’t just for web developers. If things do go south, you need a way to recover. Use Time Machine if you’re on Mac, or a third-party backup service like Backblaze, Carbonite, or IDrive. Regular backups mean that even if your website is compromised, you can restore it without paying ransom or losing years of work.
You can also find more resources about securing your online presence at FTC.gov: https://consumer.ftc.gov/search-terms/cyber-security
Frequently Asked Questions
Absolutely not. Never click links in suspicious emails.
If you receive an email that might be legitimate but you’re not sure, here’s what to do instead:
– Open a new browser tab
– Type the company’s official website address directly (like godaddy.com or bluehost.com)
– Log into your account there
– Check your account dashboard for any real notifications or issues
If there’s a genuine problem with your account, you’ll see it when you log in directly. The email link is never necessary and clicking it when it’s a phishing attempt can:
– Install malware on your computer
– Take you to a fake login page that steals your password
– Track that your email address is active (leading to more spam)
– Start a download you didn’t intend
When in doubt, never click. Go directly to the source instead.
Check three things: the sender’s actual email address (not just the display name), where links go when you hover over them, and whether the message creates artificial urgency. Legitimate companies don’t threaten to suspend your account in 24 hours. When in doubt, don’t click anything in the email—go directly to the company’s website and log in there. If there’s a real issue, you’ll see it in your account dashboard.
Change your password immediately for any account that might be affected. If you entered payment information, contact your bank or credit card company. Enable multi-factor authentication if you haven’t already. Monitor your accounts closely for the next few weeks. If the phishing attempt targeted your domain or hosting account, contact your provider’s support team directly and let them know what happened.
Run a full virus scan immediately. If you’re on Windows, use Windows Defender (built-in) or other antivirus software. Mac users also need antivirus protection! I recommend Bitdefender but there are other security options too. Don’t assume you’re safe just because nothing seems wrong. Malware often runs silently in the background.
After scanning, change passwords for important accounts from a different device if possible, or at minimum after confirming your computer is clean. If you downloaded and opened an attachment, disconnect from the internet until you’ve completed a scan.
How can I check if my email has been compromised?
Visit haveibeenpwned.com and enter your email address. This free service checks if your email appeared in any known data breaches. If it has, change your password immediately. And change it on any other accounts where you used the same password. This is why password managers and unique passwords for each account matter.
Cybercriminals often obtain email addresses through data breaches, public sources, or purchased databases.
If your email shows up in multiple breaches or you’re concerned about your personal information being widely available online, consider using a data removal service like DeleteMe or Incogni. These services scan data broker sites (the companies that collect and sell your personal information) and submit removal requests on your behalf. While they can’t remove everything, they significantly reduce your digital footprint and make it harder for scammers to target you with personalized phishing attempts. These services typically cost $100-200 per year and handle the tedious work of contacting dozens of data broker sites.
Keep in mind: data removal services focus on legal data brokers, not the dark web or illegal data dumps. They’re preventive tools that reduce your exposure to future scams, not emergency response for active fraud.
Yes. Most email services have a “Report Spam” or “Report Phishing” button. Using it helps improve filters for everyone. Learn more about how to protect yourself and report phishing emails to the Federal Trade Commission at ReportFraud.ftc.gov or report them at [email protected] (an address used by the Anti-Phishing Working Group). If the email impersonates a specific company (like your hosting provider), forward it to their abuse or security team, most have a dedicated address for reporting phishing attempts.
If you got a phishing text message, forward it to SPAM (7726).
Your domain registrar is where you registered your domain name (like GoDaddy or Namecheap). Your hosting provider is where your website files actually live (like Bluehost or SiteGround). Sometimes they’re the same company, but often they’re not. Scammers exploit this confusion by sending fake renewal notices that mix up these services. Knowing which company handles what makes suspicious emails easier to spot.
Check at least twice a year, and always enable auto-renewal with a valid payment method. Most registrars send legitimate renewal reminders 30-60 days before expiration. If you suddenly get a “final notice” for a domain that isn’t expiring for months, it’s almost certainly a scam.
Yes. Password managers are one of the most effective security tools available, and they’re easier to use than trying to remember dozens of passwords. They generate strong, unique passwords for every account and store them securely. Popular options include 1Password, Bitwarden, and Dashlane.
If you reuse the same password across multiple sites and one of those sites gets breached, scammers can use that password to access your other accounts. A password manager solves this by creating a different complex password for each site—passwords you’ll never need to remember or type.
Most password managers also store other sensitive information securely (credit cards, secure notes, software licenses) and can alert you if any of your passwords appear in known data breaches. Many of these services have free versions or a small annual cost – well worth it for the security and convenience.
I’m so glad you asked! An unsecured WiFi network is an open door for attackers who can intercept your data, access your devices, or use your connection for illegal activity.
Start with these basics: change your router’s default admin password (never leave it as “admin/admin”), use WPA3 encryption (or WPA2 if your router doesn’t support WPA3), and create a strong WiFi password that’s at least 12 characters long.
Don’t broadcast your network name to neighbors. You can hide your SSID in your router settings. If you work from home or handle sensitive business information, consider setting up a separate guest network for visitors so they’re not on the same network as your business devices. Finally, keep your router’s firmware updated. Manufacturers release security patches regularly, and outdated firmware is a common vulnerability.
If you’re not comfortable accessing your router settings, your internet service provider can often help you configure these security measures.
Protection starts with preparation
Where there is opportunity, there will be exploitation. Learn the patterns scammers use, keep your accounts organized, and pause when something feels threatening or demands immediate action.
An ounce of prevention is worth a pound of cure:
- Antivirus software (Windows Defender, Malwarebytes)
- Password manager (1Password, Bitwarden, Dashlane)
- Multi-factor authentication on critical accounts
- Auto-renewal on domains to eliminate expiration pressure
- Backup your data
Security is about creating barriers to entry, making yourself enough of a challenge that scammers move on to easier targets. With these practices in place, you’re no longer low-hanging fruit.
If you aren’t sure about a renewal notice, need to sort out your domain and hosting accounts, or need help implementing security practices, reach out.
