This is the Sunday Signal, the weekly roundup that goes out as a blog post and as the weekly Web Managers letter. It lands on Saturday with the quick win, so the weekend task and the week's reading arrive together.
Week five of Security Month was about keys: how many you have, how many are copies of each other, and who holds them. Monday counted the copies, Tuesday rehearsed the notice that one has leaked, Wednesday and Friday asked whether everyone can get through the front door at all, Thursday proved the mail carries your name and nobody else's, and today's quick win made sure no door has only one keyholder. Next week finishes Security Month with the question that ties it together: who still has access?
What ran this week
Monday's web check was "The Password Audit You Can Finish Before Lunch." Open the vault's health report, write down the counts of reused, weak, and exposed passwords, and rotate the reused and exposed ones in damage order, email first.
Tuesday's Emergency File was "Your Password Is in a Breach. Now What?" A breach notice is a weather report, not a burglary in progress. Verify it without clicking its links, rotate the breached account, hunt the family tree of reused passwords, and confirm two-factor authentication (2FA) everywhere that matters.
Wednesday was Episode 7 of The Web Managers Podcast, Design, Mobile, and Accessibility Basics, with "A Website Everyone Can Use" as its companion. The phone is the site, the eight accessibility fixes are editing-screen repairs, and the overlay widget is a sticker over the lock.
Thursday translated SPF, DKIM, and DMARC into plain English with one metaphor: the approved-courier list, the tamper-evident seal, and the instruction card. Set them up in order, start DMARC at none, and let the reports decide when to tighten.
Friday was Book Friday, Chapter 6: the phone version is the site, and design, mobile, and accessibility are systems rather than talents.
Saturday's quick win named a second administrator on every critical account, each with their own login and their own 2FA, so no single phone or departure locks the organization out.
The one thing to do this weekend
Paste your domain into MXToolbox's free SPF and DMARC checkers and write down what you see. Two green checks earn a dated line in the decisions log. A red mark on either one means some share of everything your organization sends is being filtered silently, and Thursday's post is the fix. Five minutes.
What is coming
Monday is "Who Still Has Access? The Quarterly Door Check," the review that asks two questions of every name in the inventory. Tuesday's Emergency File is "There's Someone Inside the Mailbox." Wednesday is Episode 8, Content Strategy and the Maintenance Calendar, with a companion post on the maintenance hour that prevents emergencies. Thursday makes the case for the incident log as the cheapest insurance policy you will hold. Friday is Book Friday, Chapter 7. Saturday's quick win deletes the plugins nobody uses, and the Signal closes out Security Month.
One more thing
Five weeks ago the honest answer to "who can get into our accounts" was a shrug for most organizations. If you have followed along, the answer is now a list, with two names on every critical line and no password doing double duty. That list is the access audit, and next week you learn to repeat it every quarter.
~ Bryan
If a friend got handed the website, forward this. They can join the weekly Web Managers letter with a free account at https://webmanagers.com/register, and the chapter worksheets come with it.