This is the Sunday Signal, the weekly roundup that goes out as a blog post and as the weekly Web Managers letter. It lands on Saturday with the quick win, so the weekend task and the week's reading arrive together, and this one lands on Halloween, which is as good a day as any to talk about doors.
The theme of week four of Security Month was simple: fewer doors, each one harder to open, and a calm plan for the day someone opens one anyway. Monday added a second lock to every account that matters. Tuesday rehearsed the fifteen minutes after a colleague hands a password to the wrong page. Wednesday and Friday took up the platform question, and Thursday explained why none of this is personal.
If the month has felt like a long list, the recap below is also a record of how much is behind you. Next week closes Security Month with passwords, email authentication, and something new for Fridays.
What ran this week
Monday's web check turned on two-factor authentication (2FA) everywhere that touches the website, in order of how much damage each account could do alone, registrar first. The step most people skip is custody: the second factor belongs on an organizational device or in the shared vault, not only on one person's phone.
Tuesday's Emergency File was "Someone Clicked the Link." Thank the person first, because reporting speed is your real security posture. Then change the password and end every session, chase every place that password was reused, and check the account for forwarding rules and messages nobody wrote.
Wednesday was Episode 6 of The Web Managers Podcast, Choosing Your Platform Without Regret. Ask what a platform costs to leave, price your own hours honestly, and treat every plugin as a small debt rather than a free gift.
Thursday explained why small organizations get hacked: nobody targets them. Bots scan for version numbers, not mission statements, and the defense is an afternoon of baseline work plus a schedule.
Friday was Book Friday, Chapter 5: before you pick a platform, ask what it costs to leave. Five axes instead of a feature list, and the three-year math with your own hours in it.
Saturday's quick win removed the connected apps that still hold keys to your accounts but no longer do anything for you.
The one thing to do this weekend
Count your website's administrator accounts. Demote anyone who does not strictly need administrator access, delete every account belonging to someone who has left, and confirm 2FA on the ones that remain. Keep at least two, so no single departure or lost phone locks the organization out. Under thirty minutes.
What is coming
Monday is the password audit you can finish before lunch. Tuesday's Emergency File covers the notice that your password is in a breach, and what to do before anyone uses it. Wednesday is Episode 7, A Website Everyone Can Use. Thursday translates SPF, DKIM, and DMARC, the email authentication records, into plain English. Friday brings something new to the blog. Saturday's quick win is naming a second administrator on every critical account.
One more thing
Notice how much is already behind you: a tested backup, a vault, a breach check, 2FA, and fewer doors than four weeks ago. Security at this scale is housekeeping with consequences, and you have been doing the housekeeping.
~ Bryan
If a friend got handed the website, forward this. They can join the weekly Web Managers letter with a free account at https://webmanagers.com/register, and the chapter worksheets come with it.