The most useful protections are straightforward. You don't need to be a security specialist to make a computer significantly harder to attack.

Keep software updated
Install operating-system, browser and application security updates promptly. Remove software you no longer use. Updates often fix known weaknesses that attackers already understand.

Use built-in security protection
On Windows, keep Microsoft Defender and the firewall enabled unless a suitable managed alternative is in place. Treat unexpected security warnings seriously.

Protect accounts
Use unique passwords, preferably managed by a reputable password manager. Enable multi-factor authentication on email, banking and other important accounts.

Make backups
Keep copies of important documents and photos on a separate device or secure backup service. Make sure ransomware cannot easily delete every copy, and periodically test that files can be restored.

Be cautious with messages
Verify unexpected payment requests and sign-in links. Don't open attachments or run software simply because a message appears to come from someone you know.

For a Windows computer, these measures provide a strong starting point. The UK's National Cyber Security Centre has additional advice in its cyber security guidance for individuals and families National Cyber Security Centre

A website needs protection at several levels: the web application, its server, its database, administrative accounts and the hosting provider.

A site can have a padlock in the browser and still be vulnerable. HTTPS protects information in transit; it does not prove that the website's code or access controls are secure.

The essential website safeguards

B. Protect the database

Use parameterised SQL queries, give the website's database account only the permissions it needs, keep database credentials outside publicly accessible files, and prevent direct public access to database services.

C. Validate and authorise requests

Validate incoming data on the server, escape output appropriately, use CSRF protection for sensitive actions and check permissions for every record being read or changed.

D. Maintain the software

Update PHP, libraries, frameworks, plugins and server components. Remove abandoned dependencies and disable features you do not need.

E. Monitor and recover

Keep logs of logins, permission failures and important changes. Back up both the database and website files, and test that you can restore them.

These measures address several of the risks highlighted in the OWASP Top 10:2025, including broken access control, security misconfiguration, software supply-chain failures, injection and authentication failures. OWASP Top 10:2025

A practical PHP and MySQL example

Suppose your website has a URL that displays a booking by its ID:

/booking.php?id=1234

A common mistake is to assume that a user who is logged in can access any booking simply by changing the number in the URL.

A safer application checks both authentication and ownership or authorised role on the server:

// Conceptual example: the user must be authorised
// to view this particular booking.

$stmt = $pdo->prepare(
'SELECT * FROM bookings
WHERE booking_id = :id
AND company_id = :company_id'
);

$stmt->execute([
'id' => $bookingId,
'company_id' => $authorisedCompanyId
]);
$booking = $stmt->fetch(PDO::FETCH_ASSOC);

This illustrates tenant isolation: a customer or business operating under one company must not be able to retrieve another company's booking merely by changing an identifier.

The example assumes that $authorisedCompanyId has already been established securely from the authenticated user's permissions. It must not simply be copied from an untrusted request parameter.

For a multi-tenant booking platform, this is especially important. A single missing authorisation check could expose records belonging to multiple businesses.

Six website checks worth carrying out

Website security checklist

• Administrator accounts use unique credentials and MFA where available
• PHP, libraries, plugins and server software are supported and updated
• Database queries use prepared statements where applicable
• Every sensitive operation checks the user's role and record ownership
• Backups include both website files and the database
• Logs and alerts cover failed logins and important administrative changes

This checklist is a starting point, not a penetration test or guarantee of security.

A business needs more than secure computers. It must protect its people, accounts, suppliers, customer information and ability to continue trading after an incident.

The UK's National Cyber Security Centre (NCSC) has a Small Organisations Guide to Cyber Security, which covers account security, devices, backups and recognising attacks.

The six business priorities

1. Control who has access
   Give each employee their own account. Grant only the permissions required for their job. Remove access promptly when someone leaves or changes roles.
2. Protect money and payment processes
   Independently verify changes to supplier bank details. Require a second person to approve significant payments and investigate unusual transactions.
3. Train staff
   Teach employees how to recognise impersonation, report suspicious emails and verify unusual requests. Make reporting a mistake easy and blame-free so problems are raised quickly.
4. Check suppliers and service providers
   Review who can access business systems, what information they hold, how they secure it and what happens if their service is compromised.
5. Protect business-critical data
   Back up customer records, accounts, email and operational documents. Keep at least one backup protected from routine administrator access, and test restoration regularly. National Cyber Security Centre
6. Plan for an incident
   Decide who will respond, how you will contact them if email is unavailable, which services must be restored first and when to seek specialist help.

No security arrangement eliminates all risk. A business should be prepared for the possibility of a compromised account, stolen data or ransomware.

First: contain the problem
Isolate affected devices or systems where appropriate. Contact your IT or incident-response provider. Do not assume that deleting suspicious files solves the problem.

Second: establish what happened
Preserve logs and other evidence. Determine which accounts, systems and data were affected, and whether the attacker may still have access.

Third: recover safely
Close the entry point, secure credentials, rebuild affected systems where necessary and restore from verified backups.

Fourth: meet reporting obligations
In the UK, a personal data breach may need to be reported to the Information Commissioner's Office (ICO), generally within 72 hours of becoming aware of it where the legal reporting threshold is met. Other contractual or regulatory reporting requirements may also apply.

Priorities depend on what you are protecting. For a small business, I would generally start with email and administrator accounts, multi-factor authentication, tested backups and software updates. For a website, I would also review authorisation checks, database access and the ability to restore the site quickly.

The NCSC's Cyber Action Toolkit
offers small businesses a structured route through foundational, improving and enhanced security measures.

1. Secure your most important accounts
   Start with your primary email, hosting control panel, domain registrar, database administration account and any payment service.
   • Use a unique password for every account.
   • Enable multi-factor authentication wherever available.
   • Review recovery email addresses, telephone numbers and active sessions.
   • Remove old accounts and revoke access that is no longer required.
2. Check that backups actually work
   Make a fresh backup of your important computer files, website files and database.
   • Keep a copy separate from the system being backed up.
   • Ensure ordinary compromised accounts cannot delete every copy.
   • Restore a few files to a separate location to prove the backup is usable.
   • Record where backups are stored and how to restore them.
3. Check the Windows computer
   
   • Open Windows Security -> Virus & threat protection.
   • Check that real-time protection is enabled and protection updates are current.
   • Run a scan.
   • Open Settings -> Windows Update and install available security updates.
   • Confirm that the Windows firewall is enabled.
4. Check the hosting account
   Sign in directly through your hosting provider's known website, not an email link. Review administrator accounts, recent login activity, available backups and any unexpected changes to website files or settings.

Microsoft documents the Windows Security checks and ransomware protections in its Windows security guidance Microsoft Support

If you find an unknown administrator, suspicious login or unexplained file changes, investigate before simply deleting evidence. If you suspect an active compromise, prioritise containment and expert assistance.

For a PHP and MySQL website, concentrate on access control, database security, file integrity and recovery. OWASP identifies broken access control as a leading web application security risk.OWASP Top 10:2025

In cPanel, check the following. Menu names can vary by hosting provider.

• Multi-factor authentication: enable it for cPanel and the hosting account if supported.
• PHP version: confirm that the site runs a PHP version still receiving security updates.
• SSL/TLS: confirm that HTTPS works correctly and that HTTP redirects to HTTPS.
• File permissions: ensure files and directories are not unnecessarily writable by everyone.
• Directory exposure: confirm that directory listing is disabled and that backups, source-control files, configuration files and logs cannot be downloaded publicly.
• Admin access: remove unused accounts and use separate accounts for separate people where possible.

Don't change file permissions recursively or change PHP versions on a live website without checking the application's requirements and having a working backup.

These are the checks I would prioritise in a PHP application:

For a multi-tenant booking system, test tenant isolation particularly carefully. Checking a user's company only when displaying the page is insufficient: the server must also enforce that boundary on every database operation that reads or changes tenant data.

1. Identify which database accounts the website uses.
2. Confirm that the application account has only the permissions it requires.
3. Check that database administration tools are not unnecessarily exposed to the public internet.
4. Verify that backups cover the database and that you can restore one without overwriting the live database.
5. Review any available logs for unexpected administrative changes or unusual access.

Safe testing rule: test against a staging copy or a separate test database wherever possible. Do not perform destructive security tests against a live customer database.

Accounts and responsibilities

Maintain a list of people with access to email, computers, hosting, finance and customer records. Identify who approves payments and who can restore systems.

Payment fraud

Require independent verification of supplier bank-detail changes and a second approval for significant payments. Never rely solely on contact details in the message requesting the change.

Monitoring

Ensure you can identify repeated failed logins, new administrator accounts, unexpected file changes and unusual activity involving customer records.

Incident plan

Write down who to contact, where clean backups are held, how to contact staff if email fails and which business services must be restored first.

At least once, run a simple recovery exercise:

• Can you restore a document from the computer backup?
• Can you restore the website files to a separate location?
• Can you restore the database to a test database?
• Do you know how to regain access to the hosting account if your normal email is compromised?
• Can the business continue to communicate with customers if the website and email are unavailable?

Record the date, result and any problem found. A backup that has never been restored is an untested assumption, not a proven recovery plan.