Logs are the closest thing a small business has to a security camera for its digital systems. They record who connected, what was requested, when it happened, and whether it succeeded or failed. Most hosting environments and email platforms generate logs automatically. The challenge is not creating them — it is knowing which logs to look at, what to look for, and how long to keep them.
Which logs to preserve first
The most useful logs for a small business are: web server access logs (records of every request to your website), authentication logs (records of login attempts and outcomes for your email platform, hosting control panel, and website admin), and email logs (records of messages sent and received, particularly useful for detecting spam campaigns using your domain).
Most hosting providers generate access logs and make them available through the control panel (cPanel → Logs, or similar). These logs are typically retained for a limited period — anywhere from a few days to 30 days depending on the provider. If you are investigating a suspected incident, download and preserve the relevant logs immediately before they are overwritten. Once they are gone, the timeline is gone with them.
Email platform logs (in Google Workspace: Admin Console → Reports → Audit → Login; in Microsoft 365: Admin Center → Reports → Audit Log) record successful and failed sign-ins, including IP address and device information. These are invaluable when investigating a suspected account compromise. They are also retained for a limited period — Microsoft 365 typically retains audit logs for 90 days on standard plans, longer on E3/E5 subscriptions.
Common login and web events to look for
In access logs, look for: unusually high request rates from a single IP address (may indicate scanning or brute force); requests to PHP files in unexpected locations (may indicate a web shell being accessed); 404 errors in bulk for paths like /wp-login.php, /xmlrpc.php, or /admin/ (may indicate automated scanning); and successful requests to PHP files you do not recognise.
In authentication logs, look for: failed login attempts followed by a successful login (may indicate a successful brute force or credential stuffing attack); logins from IP addresses in countries where you do not operate; logins at unusual times (3am, during a holiday you have documented elsewhere); and multiple failed logins from many different IP addresses (may indicate a distributed brute force campaign).
How long to keep evidence
For general security hygiene, retaining 90 days of web access logs and email authentication logs is a reasonable baseline for a small business. This window covers most incidents, which are typically discovered days to weeks after they began. For businesses in regulated sectors or those that have experienced previous incidents, longer retention (one to two years) is worth considering.
- Download and preserve logs immediately when investigating an incident — they are often overwritten within days.
- In cPanel: Logs section contains access logs, error logs, and raw access logs.
- In Google Workspace Admin: Reports → Audit → Login for authentication events.
- In Microsoft 365: Admin Center → Compliance → Audit for authentication and file access events.
- Look for bulk requests to
/wp-login.phpor/xmlrpc.php— these indicate automated attacks on WordPress. - Flag sign-ins from unexpected locations and times — compare against your travel and work schedule.
Logs are the timeline when something suspicious happens.
Open the cyber protection tools