We begin by understanding how your team actually works with the website. We ask who has logins, how passwords are shared, whether the same password is used for email and the dashboard, who can install plugins, who uploads files and how former staff or agencies were handled. We also look at the devices and networks used, such as personal phones and public Wi-Fi. This gives a picture of real risks, not generic ones. Next we agree the few rules that matter most for your business. A typical list includes: every person has their own login; passwords are long and unique and stored in a password manager; two-step verification is switched on for the dashboard, email and hosting; only trusted people have administrator roles; plugins and themes come only from official or paid, reputable sources; updates are applied promptly or by the maintenance provider; files are scanned before upload; and anyone who leaves has access removed the same day; see login protection. We then run the training in plain language, with examples from small businesses in India. We show how phishing emails and fake invoice, courier or bank messages look, how to check a sender and a link, and what to do when unsure. We demonstrate a password manager and set one up with each learner, and we practise switching on two-step login using an authenticator app. We explain why shared accounts hide who did what and why old accounts are dangerous. We show how to recognise a hacked website: strange redirects, unfamiliar admin users, new pages in search results, warnings in the browser or a sudden slowdown. Then we give a short response plan: stop, do not delete anything, note the time and symptoms, change passwords from a clean device, tell the named contact and call your maintenance provider; see malware cleanup and recovery and website backups and restoration. We also cover safe habits for email, since a hijacked mailbox can reset every other password, and for social and ad accounts linked to the site. We finish with a short quiz and a one-page checklist that staff can pin near their desks. For firms with many users we offer a refresher after a few months and a simple phishing test with your permission. We link the habits to your policies, such as who approves new plugins and how access is reviewed each quarter; see standard operating procedure documentation. We cannot guarantee that every employee follows every rule or that attackers will not find another route, but regular, practical training turns your team from the weakest link into a useful line of defence.
