Many of today’s breaches do not start with clever malware. They start with someone logging in. This month, Japanese media group Nikkei disclosed its third security incident in about a month: attackers used stolen credentials to reach a development system and exposed about 1.83 million records, around 150,000 of which contained personal details such as names and email addresses. Earlier incidents at the same company involved a hijacked Google Workspace account and a compromised Microsoft 365 account that was used to send spear-phishing emails to staff.

Small businesses use exactly the same platforms, often with default settings left untouched. The good news is that both Microsoft 365 and Google Workspace include strong protections, and most can be switched on by an administrator in an afternoon. This guide walks through the most important steps. You will need an account with administrator rights.

Step 1: Protect the admin accounts first

An attacker who controls an administrator account controls everything, so start here.

1. Use separate admin accounts. Give administrators a dedicated admin login that is not used for daily email or browsing.
2. Keep the number small. Two administrators is usually enough for a small business: one main and one backup, so you are never locked out.
3. Turn on the strongest sign-in method available for those accounts, such as a hardware security key or an authenticator app, before anything else.
4. Store a break-glass account securely: an emergency admin login, with its recovery details written down and kept offline.

Step 2: Enforce multi-factor authentication for everyone

Multi-factor authentication (MFA) means a stolen password alone is not enough to sign in. The key word is enforce: offering MFA as optional leaves gaps.

In Microsoft 365

1. Sign in to the Microsoft Entra admin center (entra.microsoft.com).
2. If you do not have advanced licences, make sure Security defaults are enabled. They require all users to register for MFA and block older, weaker sign-in methods.
3. If your plan includes Conditional Access, create a policy that requires MFA for all users and all cloud apps, and test it on a small group first.

In Google Workspace

1. Sign in to the Google Admin console (admin.google.com).
2. Go to Security, then the 2-Step Verification settings.
3. Allow users to turn on 2-Step Verification, give staff a short enrolment period, and then set enforcement to on.
4. Where possible, restrict methods to security keys or the Google prompt rather than SMS codes.

Tell staff before you enforce MFA, and set a date. A short notice prevents a Monday morning full of lockouts.

Step 3: Close the side doors

Attackers often bypass MFA through older protocols or connected apps.

• Block legacy authentication. Older email protocols such as POP, IMAP and basic SMTP authentication may not support MFA. In Microsoft 365, Security defaults or a Conditional Access policy can block them. In Google Workspace, review the settings for less secure app access and IMAP for users who do not need them.
• Review third-party app access. Staff may have granted outside apps permission to read mail or files. In Microsoft Entra, review Enterprise applications and consider requiring admin approval for new app consents. In the Google Admin console, open Security > Access and data control > API controls to see and restrict connected apps.
• Stop automatic forwarding. Criminals who take over a mailbox often set a rule to copy all mail to an outside address. Disable automatic external forwarding unless there is a business need.

Step 4: Turn on alerts and check sign-in logs

You want to know quickly when something looks wrong.

1. In Microsoft 365, review sign-in logs in the Entra admin center and alert policies in the Microsoft Defender portal (security.microsoft.com). Look for sign-ins from unexpected countries and new inbox rules.
2. In Google Workspace, use Reporting > Audit and investigation for login events, and check Rules for alerts such as suspicious login and user granted admin privilege.
3. Send alerts to a shared mailbox that more than one person checks.
4. Set a recurring 15-minute weekly slot to skim the logs. Regular, small checks catch problems early.

Step 5: Plan for the day a login is stolen

Even with good controls, an account may be compromised. Prepare the response in advance:

• Know how to reset a password and sign the user out of all sessions in your admin console.
• Know how to revoke app tokens and remove suspicious inbox rules.
• Write a one-page checklist listing who to call, including your IT provider and bank, if a mailbox is used for fraud.
• Remove accounts promptly when staff leave, and transfer their data to a manager.

Quick checklist

• Separate, protected admin accounts, kept to a minimum
• MFA enforced for every user, not just offered
• Legacy sign-in blocked and external forwarding disabled
• Third-party app access reviewed
• Alerts on and logs checked weekly
• A written plan for a compromised account

Menu names change from time to time as Microsoft and Google update their consoles, so if a setting has moved, search for it by name inside the admin portal. The steps themselves remain among the most effective defences a small business can put in place.

Sources

• BleepingComputer: Nikkei discloses third data breach in a month, 1.8M records exposed

Featured image: Photo: “UF Norman Office Laptop Desk Workstation” by cdsessums, CC BY 2.0, via Openverse — source

Most small business websites run on PHP, the programming language behind WordPress and many other platforms. Yet few owners know which PHP version their site uses, or that old versions stop receiving security fixes. With PHP shipping an urgent security release on 21 October 2026 and PHP 8.2 reaching the end of its security support on 31 December 2026, now is a good time to check. This step-by-step guide is for business owners, office managers and junior web admins using shared hosting with cPanel, or a WordPress site. You do not need to be a developer to follow it.

Key takeaways

• You can see your PHP version in WordPress under Tools > Site Health > Info > Server, or in cPanel’s MultiPHP Manager.
• As of October 2026, php.net lists PHP 8.2, 8.3, 8.4 and 8.5 as supported. Anything older gets no security fixes.
• Always back up your files and database before changing PHP versions.
• Test on a staging copy first if your host provides one, then switch the live site.
• If something breaks, switch back temporarily, but only to a version that still receives security updates.

Why your PHP version matters

Each PHP branch gets a period of active support, followed by a period where it receives only security fixes, and then nothing at all. According to php.net’s supported versions page, as of 21 October 2026:

• PHP 8.5: active support until 31 December 2027, security fixes until 31 December 2029.
• PHP 8.4: active support until 31 December 2026, security fixes until 31 December 2028.
• PHP 8.3: security fixes only, until 31 December 2027.
• PHP 8.2: security fixes only, ending 31 December 2026.

A site on PHP 7.4, 8.0 or 8.1 will not get patches for newly discovered flaws, including critical ones.

Before you start: prerequisites

• Your hosting control panel login (often cPanel) or your WordPress administrator login.
• A recent, complete backup that includes both the site files and the database.
• A list of the plugins and theme your site uses.
• About an hour at a quiet time for your business, such as late evening or a weekend morning.
• Your host’s support contact, in case your plan does not let you change PHP yourself.

Step-by-step: check your current PHP version

Option A: inside WordPress

1. Log in to your WordPress dashboard as an administrator.
2. Go to Tools > Site Health. On the Status tab, look for a recommended improvement about PHP; WordPress flags outdated versions here.
3. Click the Info tab, then expand the Server section. The PHP version is listed there.
4. Write the version down.

Option B: in cPanel

1. Log in to cPanel.
2. In the Software section, open MultiPHP Manager. If you cannot see it, your host may have disabled it, so contact support.
3. Find your domain in the list. The PHP version assigned to it is shown alongside. If it says inherit, the site uses the server’s default PHP version.

Step-by-step: update PHP safely

Step 1: Back up everything

Copy all of your site files and export your database. A backup is only useful if it includes both. Many hosts offer a one-click backup tool in cPanel, and WordPress users can use a backup plugin such as Duplicator. Download a copy to your computer or cloud storage, not just to the same server.

Step 2: Check plugin and theme compatibility

Visit each plugin’s page in the WordPress plugin directory and check the PHP version it supports. Update all plugins, themes and WordPress itself to their latest versions before changing PHP, because updates often add support for newer PHP releases. Plugins that have not been updated in years are a warning sign; plan to replace them.

Step 3: Test on a staging copy

If your host offers a staging site, create one so it matches your live site, then change PHP on the staging copy only. If no staging option exists, choose a quiet time and be ready to switch back.

Step 4: Change the PHP version in cPanel

1. Open MultiPHP Manager.
2. Tick the checkbox next to the domain you want to change.
3. Choose the new version from the PHP Version drop-down menu. Versions your host recommends are labelled Recommended.
4. Click Apply. If PHP-FPM is enabled for the domain, it updates to match automatically.

A good target for most sites today is PHP 8.3 or 8.4. If a version is missing from the list, it is not installed on your server or not available on your plan; ask your host.

Step 5: Test the important things

Open your site in a private browser window and test what matters to your business: the home page, navigation, contact and enquiry forms, newsletter sign-up, comments, logins and, for online shops, the full checkout process.

Step 6: Apply to the live site

Once staging works, make the same change on the live site, then repeat your tests.

Troubleshooting

The site shows a blank page or “critical error”

Switch back in MultiPHP Manager to the previous version so customers are not affected, then investigate on staging. Only roll back to a version that still receives security updates.

Finding which plugin is the problem

On a staging site, set WP_DEBUG to true in the wp-config.php file to display PHP errors and deprecated function warnings. Error messages usually name the plugin or theme folder causing trouble. Update it, replace it with a maintained alternative, or ask its developer for a fix. Turn debugging off again afterwards.

You cannot change the version yourself

Some shared hosting plans restrict PHP changes. Open a support ticket and ask the host to move your domain to a supported version, or ask about moving to a plan that allows it.

Checklist

• Current PHP version noted.
• Full backup of files and database saved off the server.
• WordPress core, plugins and theme updated.
• Plugin compatibility checked; abandoned plugins listed for replacement.
• PHP changed on staging and tested.
• PHP changed on the live site and key functions tested.
• Debug mode switched off.
• Calendar reminder set to check PHP and plugin updates every month.

Next steps

Keeping PHP current is not a one-time task. Ask your host to confirm how quickly they apply PHP security releases, such as the critical update scheduled for 21 October 2026, and add a monthly website health check to your routine. If you rely on an outside developer, ask them to confirm the PHP version in writing and to plan upgrades well before each branch reaches its end of support.

Sources

• cPanel Docs: MultiPHP Manager for cPanel
• PHP: Supported Versions
• WPMU DEV: How to Update PHP to the Suggested WordPress Version

A customer picks out goods, says the transfer has gone through, and shows you a phone screen or forwards an SMS that looks exactly like a bank credit alert. You hand over the goods. Hours later you check your account and the money never arrived. Fake bank alerts remain one of the most common frauds hitting traders, restaurants, POS agents and online sellers, and they work because they exploit speed and trust, not technology.

How fake alert scams work

Most fake alerts fall into a few patterns:

• Spoofed SMS messages. Fraudsters use bulk-SMS tools that let them set any sender name, so the message appears to come from your bank and is formatted like a genuine credit alert.
• Fake receipt screenshots. Edited images or “fake transfer” apps generate convincing receipts showing your account name, the amount and a reference number.
• Pending or reversed transfers. Some scammers start a real transfer that later fails or is reversed, then show the “processing” screen as proof.
• Pressure and distraction. The scam usually comes with urgency: a busy shop, a customer in a hurry, or a story about network problems.

The golden rule: trust your balance, not their screen

An SMS, an email, a screenshot or the customer’s phone is never proof of payment. The only reliable proof is your own account balance or transaction history, checked by you, on your own device, through your bank’s official app, internet banking or USSD service.

A five-step check before releasing goods

1. Open your banking app yourself. Don’t tap links or numbers in the message you received.
2. Confirm the new balance, not just a line in the transaction list, and make sure the amount matches.
3. Check the sender’s name in your transaction details against the name the customer gave.
4. If the transfer shows as pending, wait. Politely tell the customer goods are released once funds reflect. Genuine customers understand.
5. For large amounts, call your bank using the number on its official website or the back of your card to confirm.

Make it a business process, not a personal judgement

Fraudsters target the busiest moment and the newest staff member. Protect your team by making verification a written rule:

• Only designated staff can confirm transfers, using the business’s own banking app or a dedicated notification phone.
• Display a simple notice: “Goods are released when payment reflects in our account.”
• Turn on push notifications in your official banking app, which are harder to fake than SMS.
• Keep a log of transfers confirmed, with time and staff initials, so disputes are easy to resolve.

What to do if you’ve been caught

Act quickly. Save the screenshots, phone numbers and any CCTV footage, report the incident to your bank immediately, and file a report with the police. Warn other traders in your area; fake alert fraudsters often hit several shops in the same market on the same day.

The bottom line

A few seconds spent checking your own balance is the cheapest fraud protection a business can have. Make “confirm before you release” a habit for everyone who handles payments, and fake alerts lose their power.

Featured image: Photo: “Mobile Phone with Money in Kenya” by whiteafrican, CC BY 2.0, via Openverse — source