Browser Security for Perth Small Businesses — Perth IT Care
Your bookkeeper sits down on a Tuesday morning, opens Chrome, and something feels off. Search results are redirecting somewhere weird, there are ads on pages that never had ads before, and everything is running slower than usual. She puts in a support request assuming the computer is dying. The actual culprit: a browser extension that installed itself six months ago when she downloaded a free PDF converter, and it's been quietly reading every form she fills in — including the NAB business banking portal and the ATO Online Services login.
This isn't a far-fetched scenario. It's one of the most common security issues we see in Perth small businesses, and it's almost entirely preventable. A browser reset takes five minutes and eliminates an entire category of threat that most business owners have never thought about.
What a browser reset actually does
When you reset a browser — Chrome or Edge, the two browsers we see most in Perth SMB environments — it clears out a specific set of data: extensions and their permissions, cached credentials, cookies, session tokens, saved form data, and browsing history. The browser goes back to the state it was in when it was first installed.
What it doesn't do is equally worth knowing. A browser reset won't remove malware that's already sitting on the operating system, won't fix a compromised Windows installation, and won't recover credentials that have already been exfiltrated. If you suspect the machine itself is infected, a browser reset is a starting point, not the whole answer.
Think of it this way: the browser is a front door that you've left open for years, with a pile of junk mail blocking the lock. The reset clears the junk. It doesn't fix a broken door frame.
Why browser security matters for small business
Most cybersecurity conversations focus on email phishing, ransomware, and passwords — and those are all real risks. But the browser is the single most-used piece of software in most businesses, and it accumulates risk quietly over time.
Extensions are the main culprit. They're easy to install, often installed without much thought, and frequently granted permissions they don't need. An extension that can "read and change all data on websites you visit" has access to every form, every login, every banking page your staff interact with. Most people click through that permission prompt without a second thought.
Saved passwords in the browser are another weak point. If a staff member leaves and their browser profile isn't wiped, those credentials don't leave with their access — they sit in the browser, waiting. And cookies and session tokens can allow someone to continue accessing accounts even after a password change, if the session was captured before the reset.
For Perth small businesses handling client data, financial information, or anything under the Privacy Act 1988, browser hygiene isn't optional. It's part of the baseline.
How to review your browser before resetting
Before jumping straight to a reset, it's worth doing a quick review first. You might find the problem immediately, and a targeted fix is always better than a blunt instrument.
Check installed extensions
In Chrome: three dots menu > Extensions > Manage Extensions. In Edge: three dots menu > Extensions > Manage Extensions.
For each extension, ask: Do I know what this is? Did I install it deliberately? Does it still need access to everything it's been granted? If you can't answer yes to all three, remove it.
We've done extension reviews for Perth clients and regularly found three to five extensions per machine that nobody could identify. One client had a "coupon finder" that two staff members had installed without realising it was logging form data. It had been there for over a year. There's more on how browser extensions cause problems — and what to look for — in our browser extensions post.
Check saved passwords
Chrome: Settings > Autofill and passwords > Google Password Manager. Edge: Settings > Passwords.
If staff are saving business credentials in the browser rather than a proper password manager, that's a problem worth fixing separately. Browser-saved passwords aren't encrypted at the same level as a dedicated password manager, and they sync across devices in ways that aren't always obvious.
Check browser permissions
Chrome: Settings > Privacy and security > Site settings. Edge: Settings > Cookies and site permissions.
Look for sites with camera, microphone, location, or notification permissions that you don't recognise or didn't actively approve.
How to reset Chrome and Edge
Once you've done the review and decided a full reset is the right move, the process is straightforward.
Resetting Chrome
Settings > Reset settings > Restore settings to their original defaults > Reset settings.
This removes extensions, clears cookies and cached data, resets your homepage and search engine, and disables any themes. It doesn't delete bookmarks, browsing history stored in your Google account, or saved passwords in Google Password Manager — those are tied to the account, not the browser install.
Resetting Edge
Settings > Reset settings > Restore settings to their default values > Reset.
Same outcome: extensions gone, cookies cleared, permissions reset. Favourites and passwords synced to a Microsoft account are retained.
After the reset
Only reinstall the extensions you actually need and can name. Grant the minimum permissions each one asks for — if an extension demands access to all sites and you only need it for one specific task, that's a red flag worth investigating.
This is also a good time to move staff away from browser-saved passwords entirely. If you're on Microsoft 365, there are options worth looking at for centralised credential management that don't rely on the browser.
How often should you do this?
For most Perth small businesses, a browser review every six months is a reasonable baseline. For staff who handle financial data, client records, or have admin access to business systems, every quarter makes sense.
If you're onboarding a new staff member on an existing machine, do a browser reset as part of the handover process. Don't assume the previous user left a clean machine.
If a staff member leaves, the machine should get a full reset — operating system level, not just the browser — before it's reassigned. A browser reset alone isn't sufficient in that situation.
Where browser security fits in the bigger picture
Browser security is one layer of a larger stack. It's not a substitute for endpoint protection, MFA on your Microsoft 365 accounts, or staff who know how to spot a phishing email. But it's one of the easiest wins available, and it's consistently overlooked.
The ACSC's Essential Eight framework covers application control and patching as core mitigations — keeping browsers updated and removing unnecessary extensions falls squarely under that. If you're working toward Essential Eight compliance, browser hygiene is part of the foundation, not an afterthought. You can read more about how the Essential Eight applies to Perth small businesses in our dedicated guide.
For Perth businesses that want a more complete picture of where they stand, the right starting point is a review of the whole IT environment — not just the browser. We cover what that looks like in our post on IT infrastructure review for Perth businesses.
If your concern is more specifically around Microsoft 365 security — which is where most credential theft actually ends up mattering — there's more detail in our Microsoft 365 security guide for Perth businesses. And if phishing is on your radar (it should be), our guide on phishing protection for Perth businesses covers why email filters alone aren't enough.
The short version
Check the extensions on your staff machines. Remove anything you can't identify. Reset the browser if there's any doubt. Do it again in six months.
It won't solve everything, but it will close a door that a surprising number of businesses leave wide open. If you'd rather have someone run through this for you — or you want the whole security picture reviewed — get in touch.
