This is the Sunday Signal, the weekly roundup that goes out as a blog post and as the weekly Web Managers letter, arriving on Saturday alongside the quick win. Every issue has the same three parts: what ran this week, the one thing to do before Monday, and what is coming.
This week finished the domain work and opened the security posts proper. The order was deliberate. Cybersecurity Awareness Month produces a great deal of advice about threats aimed at organizations nothing like yours, and the honest version for a small organization starts somewhere unglamorous: the name everything is attached to, and the vault where the keys live. With the domain defended and the vault open, the rest of October's security habits have somewhere to stand. If you have been following along for two weeks, you have already closed more doors than most organizations ever do.
What ran this week
Monday's check sent you to look at your domain's expiration date, then built the layered defense in twenty minutes: the date written down, reminders at 60, 30, and 7 days on a shared calendar, the registrant confirmed as the organization, the account on a role-based address, and registrar lock on.
Tuesday's Emergency File was the domain that expired on a Saturday. Expiration is a ramp with four stages, and the first hour is about finding which stage you are on, getting into the registrar account, and renewing or restoring before the next stage arrives.
Wednesday was Episode 4 of The Web Managers Podcast: the three landlords, DNS as the contact card on your phone, and the myth that a web company owning your domain is normal.
Thursday named the five doors into your website: guessed passwords, outdated software, convincing emails, the contact form, and the key nobody collected when someone left. Four are automated. The fifth is the one most security advice skips.
Friday was Book Friday, Chapter 3: the expiration disaster is a documentation failure wearing a technology costume.
Saturday's quick win opened an organizational password vault and moved the three most important logins inside.
The one thing to do this weekend
If you did nothing else this week, do Saturday's. Twenty minutes gets the vault open, the registrar, hosting, and email logins inside it with fresh passwords, and a second administrator added. Every other security habit this month assumes the vault exists.
If that is done, do Monday's. Find every domain's expiration date and put three reminders per domain on a calendar that more than one person reads.
What is coming
Next week the security habits arrive one at a time. Monday's check asks whether your backup is real and walks a fifteen-minute restore test. Tuesday's Emergency File is the hacked site, and the first hour that decides the week. Wednesday is Episode 5, hosting without the jargon. Thursday separates the registrar, the host, and the platform, and what each one can take away. Friday's Book Friday is Chapter 4, the restore test that turns a backup into a plan. Saturday's quick win runs your email through a breach check.
One more thing
The five-doors post said something worth repeating here: nobody is deciding whether your organization is worth attacking. The bots are asking only whether your site is easier to enter than the next one. Two weeks of inventory, ownership, renewal, and vault work have already made it harder. The next two weeks make it boring, which is the goal.
If a colleague got handed the website, forward this. They can get the letter and every worksheet with a free account.
Bryan
Get the letter every week. One week in review, one thing to do, one link, every Saturday, with every worksheet from the book and the podcast included. Create your free account.