When you start out, security competes with everything else, and everything else feels more urgent. So this is deliberately the minimum that actually matters, not the full audit. Do these five things once, near the start, and you have skipped past the mistakes we most often get called in to clean up later.

Start with the domain and email. Buy your own domain in your own account, and use it for a proper email address rather than a free personal one. This is not vanity: it means the domain is yours to control, and it stops a customer wondering whether name@gmail is really you. Keep the login to the domain somewhere you will still have it in three years.

Then turn on the second factor - the code or the tap on your phone - for that email and for anything with money in it, the bank, the payment provider, the accounting tool. Email is the master key, because it is where password resets land. Protecting it well protects almost everything downstream.

Next, backup. Switch on automatic backup for the documents and photos you cannot recreate, and know where they land. A sole trader losing the invoices folder is a genuine business problem, and it is entirely avoidable for a few pounds a month. If you can, open the backup once to confirm the files are really there.

Last, write one page for customers: how they can reach you, how you will and will not ask them to pay, and that you will never phone asking them to move money. It sounds small, but when a scammer later impersonates you, that page is the thing that lets an honest customer check. Fifteen minutes now, far fewer bad days later.