Locking down your business accounts: domain, Google, Meta

Short answer: Start with the two accounts that can reset everything else: your domain registrar and your main business email. Turn on two-factor authentication (2FA) there first, preferably with passkeys, security keys or an authenticator app rather than text messages, and store recovery codes somewhere safe and offline. Then work down the list: Google, Meta, app store developer accounts, payments and your website, giving each person their own login instead of sharing passwords.

Most small-business account takeovers don't need clever hacking. A reused password, a phished login or a former contractor who still has access is enough. The fix is boring and takes an afternoon.

Why the order matters

Your accounts form a chain. Whoever controls your email can reset most other passwords. Whoever controls your domain can redirect your email and website. So protect them from the top down. The UK's National Cyber Security Centre puts email at the top of its 2-step verification advice for the same reason.

Priority checklist by account

1. Domain registrar (where you bought your domain)

[ ] Log in and confirm the account is in the business's name, with an email address the business controls (not a former web designer's).
[ ] Turn on 2FA.
[ ] Check that the domain is locked against transfers. ICANN explains that this status may be called "Registrar lock" or "Client Transfer Prohibited", and to contact your registrar if you can't set it yourself.
[ ] Turn on auto-renew and check the card on file.
[ ] Remove old users or delegated access you don't recognize.

2. Main business email (Google Workspace, Microsoft 365 or other)

[ ] Turn on 2FA for every user, starting with admins.
[ ] Give admin rights only to people who need them, ideally on a separate admin login.
[ ] Check recovery phone numbers and recovery email addresses on admin accounts.
[ ] Review email forwarding rules. A hidden rule forwarding invoices to an outside address is a common sign of compromise.
[ ] Remove accounts of people who have left, or convert them to shared mailboxes.

3. Google account and Google Business Profile, Ads, Analytics

[ ] Add a passkey. Google's help explains that a passkey lets you sign in with your fingerprint, face scan or screen lock, that it can't be shared or written down, and that this makes it more secure against phishing.
[ ] Generate backup codes. Google's help describes them as the second step to use if you lose your phone or change your number. Print them and keep them somewhere safe.
[ ] Make sure Business Profile, Ads, Analytics and Search Console have at least two owners or admins from the business, each signing in with their own account.

4. Meta (Facebook and Instagram)

[ ] Turn on 2FA on every personal account that has access to your Page or business portfolio. Meta access depends on these personal logins.
[ ] In your business portfolio settings, require 2FA. Meta's Business Help Center (as of November 2026) says that for portfolios under 90 days old the requirement is optional and can be set for admins only or for everyone, and that Meta automatically requires it for some portfolios older than 90 days.
[ ] Review people and partners with access. Remove agencies and freelancers who no longer work with you.
[ ] Make sure at least two trusted people have full control, so one locked-out account doesn't lock out the business.

5. App store developer accounts

[ ] Apple: Apple's developer support page states that two-factor authentication is required for program Account Holders, and that 2FA or two-step verification is required for all users signing in to App Store Connect. Keep the Account Holder's contact details current.
[ ] Google Play Console: turn on 2FA on the owner account and give team members their own access with limited permissions.
[ ] Confirm the developer accounts are in the business's name, not a freelancer's.

6. Payments and banking

[ ] Use the strongest 2FA each provider offers for your payment processor, online banking and accounting software.
[ ] Use separate user logins with limited roles: someone who issues refunds doesn't need to change payout bank details.
[ ] Turn on alerts for payout detail changes and new user invitations.

7. Website and hosting

[ ] Turn on 2FA for hosting, CMS admin (WordPress, Shopify, etc.) and any CDN or DNS provider.
[ ] Remove old admin users and agency logins.
[ ] Check who has access to backups.

Choosing a 2FA method

From strongest to weakest, roughly:

Passkeys or hardware security keys. Resistant to phishing because there's no code to type into a fake page.
Authenticator apps. Codes generated on the phone. Good, but a convincing fake login page can still ask for one.
Text message codes. Better than nothing; vulnerable to SIM swaps and phishing.
Email codes. Only as strong as the email account, which is why email comes first.

Use the strongest option each service supports, and keep a fallback for when a phone is lost.

Recovery codes and shared access

Recovery codes. Print them or store them in a password manager's secure notes. Not in a folder called "passwords" on the shared drive.
No shared passwords. Nearly every service above lets you invite people with their own login and role. That gives you a record of who did what, and you can remove a person without changing everyone's password.
Password manager. For the few logins that truly have to be shared, use a business password manager with shared vaults rather than a spreadsheet.
Offboarding list. Keep a short list of every service each person can access, and work through it the day someone leaves.

FAQ

What if a former web designer owns our domain or Meta Page?

Ask them to transfer ownership or add you as owner now, while you're on good terms. If they won't respond, contact the registrar or platform support with proof of business ownership.

Are text-message codes good enough?

They stop most password-only attacks, so they're far better than nothing. For the domain, email and payment accounts, prefer passkeys, security keys or an authenticator app.

How often should we review access?

Every quarter, and whenever someone leaves or an agency relationship ends.

Will passkeys replace 2FA?

For Google, a passkey stands in for the password and the second step, since it proves you hold the device and can open it. Keep backup codes and a second method in case that device is lost.

If you'd like a second pair of eyes on who can access your domain, email and social accounts, tell us which services your business runs on.