On 1 October 2026, Ghana’s Cyber Security Authority opened its National Cyber Security Awareness Month with a message aimed at owners and boards as much as at technology departments: cyber risk is a business risk. For a business that takes orders, bookings and enquiries through its own website, that message is not abstract. The Authority also publishes business advisories, including one on sites that have been defaced. Here is what a business owner can act on: four checks for your own website this week, and six questions to put to whoever looks after it.
What the Cyber Security Authority has said about the 2026 campaign
The Authority’s own announcement of the campaign, dated 1 September 2026 states that the month runs from 1 to 31 October 2026 under the theme “Securing Ghana’s Digital Finance Ecosystem: Building Trust Through Collaboration and Cyber Resilience”. The figures below were given at that launch; the Authority marked the opening of the month itself on 1 October 2026, its fifteenth anniversary.
Two figures in that announcement are worth a business owner’s attention. The Authority recorded 3,876 cybersecurity incidents between January and July 2026, with online fraud accounting for approximately 47 per cent. The same announcement cites the Bank of Ghana’s 2025 Fraud Report, in which fraud cases recorded across banks, specialised deposit-taking institutions and payment service providers rose by 48 per cent, from 16,733 in 2024 to 24,778 in 2025.
Speaking at the launch, the Authority’s Director-General said cyber attackers increasingly exploit the gaps between institutions, and told MyJoyOnline that cyber security must not remain buried in technology departments because cyber risk is a business risk. The Ghana News Agency reported the same remarks on 3 October 2026, at an event that also marked the Authority’s fifteenth anniversary.
One instruction in that announcement is worth reading closely, because it gives you a test to apply to whoever looks after your website. The Authority urged banks, fintechs, payment service providers, insurers and merchants to procure cybersecurity services only from providers licensed or accredited by it. The Authority was established under the Cybersecurity Act, 2020 (Act 1038).
Our view: this announcement does not settle what your own website needs. What it does is give you a named authority to put a provider’s answer in front of, and a set of questions worth asking this week.
Why a business website is a business system
Think about where the work actually enters the business. A shop owner keeps the catalogue on the site and takes orders by phone. A consultant’s only route to a new client is the enquiry form. A firm publishes its price list online and answers questions by email. In each case, the domain, the hosting and the site’s software are not a brochure. They are the point at which revenue arrives.
That is why the Authority’s point about board-level risk matters as much for a website as for a filing. Patching software, controlling who can reach an account and noticing quickly when a page changes are the same activities whether the system is a bank or a one-page business site. Our advice is to treat software updates, control over who can reach your accounts, and watching for unexpected changes as part of running the business, not as something a website handles on its own.
What the Authority’s own advisory tells site owners to do
The Authority’s Computer Emergency Response Team publishes advisories for businesses, and the website defacement advisory is addressed to web host users, managers and business owners in Ghana. It describes defacement as an attack that changes what a site or page displays, typically by breaking into a web server and replacing the hosted content. The advisory lists the consequences an organisation may face, among them a data breach carried out while attention is on the visible damage, visitors being sent to pages carrying malicious code, being flagged by search engines, and damage to how the business is perceived.
Its mitigation process calls for regular security audits, defences against SQL injection and cross-site scripting, monitoring tools that detect unauthorised changes to a site, and a written plan for responding before an incident happens rather than during one.
Four of its standing precautions are the practical part of the advisory. Do not open links or attachments from sources you do not recognise. Apply security updates and patches and keep to the latest versions. Share the advisory with the people who actually work in your organisation. Report an incident to CERT-GH at [email protected]. The Authority’s phishing advisory adds a further step: look up the contact’s website or number independently and call them directly, rather than using the number in the message, and change any password you think has been compromised straight away rather than reusing it elsewhere.
Six questions to ask whoever looks after your website
These follow from what the Authority has published. Ask them of any provider, and ask for the answers in writing.
| Question | What the answer should settle |
|---|---|
| Who holds the domain and hosting account, and in whose name is it registered? | Whether your business, rather than the provider, can take control of the domain and the hosting. |
| What updates the website’s software, and how often? | A named person or company, and a schedule, rather than the answer that it is handled. |
| Who watches for changes to the site that you did not make? | Whether any monitoring is in place at all, and how quickly someone would be told. |
| What happens in the first hour after the site is defaced or stops loading? | A written path, a named contact, and who you call. |
| Where are the backups kept, and when was a restore last tested? | A location and a date, not only an assurance that backups are taken. |
| Are you licensed or accredited by the Cyber Security Authority for the security services you provide? | Nothing is assumed either way. An unstated answer is unconfirmed, so ask again and get it in writing. |
That question is worth putting to any provider you are considering, and it is one we would rather you asked than assumed. We do not claim an answer to it here.
What a Sobiaonline project already covers
So that the questions above have a concrete answer, here is what our documented baseline contains. Every new website includes a design that works on phones, tablets and computers; basic on-page search setup covering heading structure, page titles, meta descriptions and image alt text; a contact or enquiry form that reaches you directly; page structure agreed with you before the build starts; and six months of technical maintenance after launch.
Those six months mean software updates within the agreed scope, routine backups, security monitoring, and correction of technical faults within the agreed scope. They do not mean unlimited redesign or entering content on your behalf.
Our services include website support and maintenance, and domain and hosting setup. For domain and hosting we guide the choice, handle the setup, and register both in your name so you keep ownership and control; they are not sold as a separate package, and renewal dates and recurring costs are explained before work begins. Scope, deliverables and timelines are confirmed in writing before work begins, and you work directly with the person responsible for understanding and delivering your website. Package starting prices are on the pricing page, and the reasoning behind them is set out in our article on how much a website costs in Ghana.
One thing we will not guess at: what happens after those six months, and what it would cost. That is not stated on our pages, so treat it as an open item and get it in writing before you commit. Examples of the kind of work we do are on our portfolio page.
Four things to do this week
- Write down who can reach your domain and hosting account today, and who cannot.
- Open the site on a phone and send yourself an enquiry through the form, so you know it reaches a person.
- Ask when a restore was last tested and write the date down. An assurance that backups are taken is not the same as a restore that has been tried.
- If customers pay or book through the site, agree in advance who checks an unexpected payment request before anyone acts on it.
If you would like the questions above applied to a quotation you already hold, or to a site that needs attention, send us the details and we will tell you what we can and cannot confirm.
Does this mean my website is at risk?
The Authority published national counts, not a breakdown by business type or by website, so nobody can tell you your specific risk from those figures. What it did publish is guidance addressed directly to web host users, managers and business owners in Ghana, and a list of what a provider should be doing about updates, monitoring and backups. That is the part you can act on this week.
Where do I report a website that has been defaced or looks fraudulent?
The website defacement advisory published by the Computer Emergency Response Team of the Cyber Security Authority gives [email protected] as the address for reporting an incident. Report it and keep your own record of what happened and when.
Find more useful website guides from Sobiaonline.
Add Sobiaonline as a preferred source on Google