Common Mistakes · 6 min read

5 cybersecurity mistakes small businesses make (fixable in an afternoon)

These are the same handful of findings that show up across most small business scans. None require a security team or a budget — most are a single DNS record or a one-line server config change.

1. No SPF or DMARC record

This is the most common finding by a wide margin. Without it, anyone can send email that appears to come from your domain — a direct path to phishing your own customers or vendors. Fix: add an SPF TXT record and a DMARC TXT record to your DNS. See our full SPF/DKIM/DMARC guide for exact values.

2. Missing security headers (HSTS, CSP)

Strict-Transport-Security (HSTS) forces browsers to always use the encrypted version of your site, closing off downgrade attacks on public wifi. Content-Security-Policy (CSP) restricts what scripts are allowed to run on your pages, which is one of the most effective defenses against cross-site scripting. Both are missing on the majority of small business sites we scan. Fix: add the headers in your web server config (Nginx, Apache) or, if you're on Cloudflare, enable HSTS directly in the dashboard under SSL/TLS → Edge Certificates.

3. Outdated software with known vulnerabilities

WordPress plugins, CMS versions, and server software that haven't been updated in months or years are one of the most exploited entry points — not because the vulnerabilities are exotic, but because they're public and well-documented (the CVE database, which RapidVuln checks sites against, exists specifically to catalog them). Fix: keep your CMS, plugins, and server software on a regular update schedule — most CMS platforms support automatic updates for minor versions.

4. Exposed ports and services that should be internal

Database ports (MySQL, PostgreSQL, MongoDB), remote access ports (RDP, VNC, Telnet), and admin panels are sometimes reachable from the open internet — usually unintentionally, left open from a default server configuration or an old setup that was never locked down. These are some of the highest-value targets for automated scanning. Fix: close ports you don't need publicly exposed at the firewall level, and put anything that must remain open behind a VPN or IP allowlist.

5. No DKIM signing

Related to #1 but distinct — DKIM cryptographically signs your outgoing email so receiving servers can verify it wasn't altered in transit. Without it, even a correctly configured SPF record only proves which server sent a message, not that the message is genuine. Fix: enable DKIM through your email provider's admin console (Google Workspace, Microsoft 365, and most other providers support this in a few clicks) and add the resulting TXT record to your DNS.