Someone built your website two or three years ago, and it looked good at launch. The developer has since moved on to other clients, nobody on your team has logged in for months, and if something went wrong tonight you are not sure who would notice first. Probably a customer.
Most of what keeps a site healthy runs by itself once someone switches it on, or takes about ten minutes a month. A handful of jobs do neither, and those are the ones that take sites down. This guide sorts every job into yours, a developer’s or your host’s, and tells you what handing them off costs.
Switch on automatic updates and automatic backups, put every renewal date in a calendar, and send yourself a test message through your contact form once a month. That covers most of the routine work, and none of it needs a developer.
Hand off PHP upgrades, anything that breaks after an update, and cleaning up a hack. Ask whoever hosts your site which PHP version it runs, because PHP 8.2 stops receiving security fixes on 31 December 2026.
If you would rather hand off everything, a monthly retainer runs GHS 100 to 500 depending on the size of the site. Cleaning up a hacked site with no backup typically costs GHS 1,500 to 4,000, which is more than a year of retainer at the lower end.
What does a neglected website look like?
In July 2026, Techpoint Africa reported that a gambling syndicate based in Indonesia had planted casino pages inside around 20 government websites across 16 African countries. Ghana was among the first six countries hit.
Anyone who typed those addresses into a browser saw the normal site. The casino pages only appeared for people who arrived from a Google search for gambling, so the staff running the sites could visit every day and see nothing wrong. The attackers got in through software that had gone years without updates. Nothing about it was sophisticated.
One Nigerian site was cleaned within hours of being reported, then found compromised again a few weeks later. Chris Nwobi, the researcher who first traced the campaign, said the content coming back was “the whole story, not the casino ads, the neglect.”
Government sites were the target because Google trusts them. A business site with a few years of search history is worth hijacking for the same reason, on a smaller scale, and there is often nobody watching it at all.
The damage arrives when Google notices. The Cyber Security Authority’s advisory on website defacement warns that a site added to a search engine’s blacklist “can lose up to 95% of website traffic.” Google labels affected pages in search results and can show visitors a full-page warning in the browser before they ever reach you. Once the site is clean, the review to lift those warnings takes, in Google’s words, “several days or weeks.”
What does maintenance actually involve?
This guide is written for WordPress, because WordPress runs 40.2% of all websites and most of the Ghanaian business sites we are asked to look after. If yours runs on something else, the jobs below still apply. Only the buttons change. We have written separately about why WordPress suits so many businesses here.
Read the table from the last column. That is what each job prevents, and it is the quickest way to decide which ones you cannot afford to skip.
| Job | How often | Who | What happens if nobody does it |
|---|---|---|---|
| Plugin, theme and WordPress updates | Weekly, or automatic | You, once switched on | Known security holes stay open |
| PHP version on the server | Every two to three years | Developer or host | The server stops getting security fixes |
| Backups | Daily or weekly, automatic | You, once switched on | A hack or a bad update has no way back |
| Test restore of a backup | Twice a year | Developer | You find out the backups were broken on the day you need them |
| SSL certificate | Automatic, checked monthly | Host | Visitors get a full-page security warning instead of your site |
| Domain renewal | Yearly | You | The site and your email stop working, and the name can be lost |
| Hosting renewal | Yearly or monthly | You | The site goes offline |
| Uptime monitoring | Continuous, automatic | You, once set up | Customers find the outage before you do |
| Contact forms and email | Monthly test | You | Enquiries vanish without an error |
| Content updates | When something changes | You | Old prices, old staff, last year’s service times |
| Data Protection Commission registration | On renewal | You | You are processing personal data without a valid registration |
| Access audit | Yearly, and when anyone leaves | You | Former staff and contractors can still log in |
Updates sit at the top for a reason. Patchstack counted 11,334 new vulnerabilities in the WordPress ecosystem in 2025, up 42% on the year before, and 91% of them were in plugins. WordPress itself had six, all low priority. About half of the serious ones were being exploited within 24 hours of becoming public. The risk on most sites lives in the plugins somebody installed at launch and never looked at again.
Put together, the routine is short: a few checks each month, a test restore of a backup twice a year, renewals and a review of who can log in once a year, and a PHP upgrade whenever a version retires.
What can you do yourself?
More than most people expect. Once the four things below are set up, keeping on top of them takes about ten minutes a month, and none of it needs you to touch code.
Turn on automatic updates
WordPress has offered automatic updates for plugins and themes since version 5.5, but they stay off until you switch them on, one plugin at a time, from the Plugins screen. Once they are on, WordPress checks twice a day and emails you after every attempt, whether it worked or failed. Read those emails. A failed update is your early warning that something needs attention.
Automatic updates will not catch everything. Patchstack found that 46% of the vulnerabilities it tracked in 2025 were still unpatched when they became public, so for those there was no update to install. What protects you there is running fewer plugins. Delete anything you are not using, since a deactivated plugin still sits on the server.
Turn on automatic backups
Ask your host two questions: are backups included in my plan, and how many days back do they go? If the answer is no, or a single day, install a backup plugin that sends copies somewhere outside your hosting account, such as Google Drive or Dropbox. A backup that lives only on the same server disappears with it.
Set up an uptime monitor
Free monitoring services will load your site every few minutes and send you an email or SMS the moment it stops responding. It takes five minutes to set up, and it means you hear about an outage before your customers start messaging you on WhatsApp to ask whether you are still in business.
Put every renewal in a calendar
Domain, hosting, any premium plugin licence, and your Data Protection Commission registration. Set each reminder a month before the due date. The section on renewals explains why a month.
While you have the calendar open, add one more recurring entry: send yourself a message through your own contact form on the first of every month. Forms break quietly. An email setting changes on the server and enquiries stop arriving, with nothing on the site to tell you.
What needs a developer?
Four jobs where a mistake costs more than paying someone to do them properly.
Upgrading PHP
PHP is the programming language WordPress runs on, and each version receives security fixes for a fixed period before it is retired. PHP 8.2 stops receiving them on 31 December 2026, and 8.1 already has. Plenty of older sites run on versions retired long before either.
The upgrade itself is usually a dropdown in your hosting control panel. The risk is that an old theme or plugin was written for the earlier version and breaks on the new one, taking pages or the whole site down with it. A developer will copy the site, try the upgrade on the copy, fix what breaks, and only then switch the live site over.
If a site is so old that every plugin breaks on a supported version, maintenance has run its course. That is the point at which a redesign starts to cost less than repairs.
When an update breaks something
Occasionally an update leaves a blank white screen or a broken layout. If your backups are working, restoring yesterday’s copy gets the site back while the cause is found. Finding out which plugin caused it, and replacing or fixing it, is developer work.
Cleaning up a hack
Removing the casino pages, spam links or redirect is the easy part. The real job is finding how the attacker got in and closing that hole, then changing every password and checking nothing was left behind. Skip that step and the problem comes back. Commenting on the Nigerian site that was reinfected, security researcher Martin Uwakwe told Technext that repeat compromises “usually mean the visible content was removed while the original point of entry stayed open.”
Getting off Google’s warning list
Once the site is clean, someone has to request a review through the Security Issues report in Google Search Console, explaining what was found and what was fixed. Google says reviews can take several days or weeks, and asks that you wait for a decision before submitting another request. Your site carries the warning for that whole period. That wait alone justifies the routine work above.
Which renewals catch Ghanaian businesses out?
Renewals look like the simplest job in the table. In Ghana they come with traps that can take a working site offline without warning, for reasons that have nothing to do with the website itself.
The card that cannot pay in dollars
Most hosting companies and domain registrars bill in US dollars and renew automatically from a card saved on the account. That card is often the weak point.
A gh-link card will not work at all, since GhIPSS, which runs the scheme, confirms that gh-link cards are not currently accepted outside Ghana. A Visa or Mastercard debit card from a Ghanaian bank usually works, provided international online payments are switched on in your banking app, the amount sits inside your daily limit, and the one-time code reaches your phone in time. Namecheap’s own help page tells customers to check that their card supports international payments, because some banks issue cards that only work locally.
When the charge fails, the provider sends a reminder to whichever email address was on the account at sign-up. If that was the developer’s address, or an inbox nobody checks, the first sign of trouble is the site going down.
Three ways around it. Renew by hand a month before the due date, so a failed payment leaves you time to fix it. Keep a credit balance with the provider, topped up in advance. Or move to a host that bills in cedis and accepts mobile money; we compare the options in our guide to hosting prices in Ghana.
The .com.gh expiry window
Generic domains such as .com follow international rules that give you a grace period after expiry. We could find no published grace period for .com.gh domains, and the registrars that sell them quote windows that contradict each other. Assume you have 30 days or less once the domain lapses, and renew well before the date.
SSL certificates that need renewing more often
The padlock in the address bar comes from an SSL certificate, and certificates now expire faster than they used to. Since 15 March 2026, publicly trusted certificates can be valid for at most 200 days, down from 398. That falls to 100 days in March 2027 and 47 days in March 2029.
Let’s Encrypt, the free certificate authority many hosting plans rely on, is shortening its certificates further. It moves to 64 days in February 2027 and 45 days in February 2028, and it stopped sending expiry reminder emails in June 2025. Renewing certificates by hand is on its way out. Ask your host one question: does my certificate renew automatically, and who is told if a renewal fails?
Your Data Protection Commission registration
A contact form, an order form or a customer login all collect personal data. Under the Data Protection Act, 2012 (Act 843), anyone processing personal data in Ghana must register with the Data Protection Commission, and the registration has to be renewed. Sources disagree on how long a registration lasts, so check the expiry date printed on your certificate and put it in the calendar with everything else.
Who holds the keys?
Everything above assumes you can log in to your own website. We regularly meet businesses that cannot. The person who built the site registered the domain in their own name, set up hosting on their own account, kept the only administrator login, and has since stopped answering calls. Nobody planned it that way. It is what happens when a site is set up quickly and nobody asks for the keys at handover.
Your business should hold these four in its own name:
- The domain, registered to the business, with the registrar login tied to an email address the business controls
- The hosting account, billed to the business
- An administrator login to the website itself
- Access to the backups, wherever they are stored
If the developer has already gone, start with the domain, because whoever controls the domain controls both the website and the email. A WHOIS lookup will usually show which company the domain is registered with. Contact that company with your business registration documents and ask what they need to transfer control to you. Hosting companies will generally help a legitimate account holder recover access. If the hosting account is in the developer’s name too, the quickest route is often to take a copy of the site and move it to a new account in yours.
On any new project, ask for all four at handover and write it into the contract before work starts. It costs nothing to arrange at the beginning and can cost weeks to untangle later.
Should you pay per fix or pay monthly?
Three ways to run maintenance, plus the one nobody chooses.
| Approach | What it costs | Fits |
|---|---|---|
| Do it yourself | Mostly free, plus your time | A simple site, and someone on your side who will actually do the routine jobs |
| Pay per fix | Quoted per job | A site that rarely changes, where you handle the routine jobs yourself |
| Monthly retainer | GHS 100 to 500 a month | Any site that brings in enquiries, orders or donations |
| Hack cleanup, no backup | GHS 1,500 to 4,000, once | Nobody. This is what skipping the rows above costs |
Where a retainer lands in that range depends on four things: how many plugins the site runs, whether it takes payments, how often the content changes, and how quickly you need a response when something breaks. A five-page brochure site for a consultancy sits near the bottom. A shop taking mobile money payments every day, or a school site busy during admissions, sits near the top.
Paying per fix suits a site that is genuinely quiet, as long as someone is doing the jobs from the do-it-yourself section. Without that, per-fix tends to end in a hack cleanup, and a single cleanup costs more than a year of retainer at the low end.
What a maintenance agreement should say
Whoever you hire, get these in writing:
- Exactly which jobs from the table above are covered, and which are billed separately
- How quickly they respond, and on which channel. WhatsApp counts
- How often backups run, how long they are kept, and where they are stored
- That the domain and every account stay in your name
- What happens to your logins and backups when the agreement ends
Frequently asked questions
Is maintenance included when I pay for a website?
Sometimes for the first few months, rarely beyond that. Ask before you sign, and get the answer in writing, including the date the included period ends and what it costs afterwards.
Can I maintain my website myself?
Most of it, yes. Updates, backups, renewals, form checks and content changes are all within reach of anyone who can use the WordPress dashboard. PHP upgrades, fixing what an update breaks, and hack cleanup are the parts to hand off.
How often should I update WordPress?
WordPress installs its own minor and security releases by default, and sites set up since version 5.6 take major releases automatically too. Plugins and themes need auto-updates switched on, after which they update as new versions arrive. If you update by hand instead, once a week is a sensible rhythm.
What happens if my domain expires?
Your website and any email on that domain stop working. If it stays unpaid past the registrar’s grace period, it can be released for anyone to register. For .com.gh domains, assume that window is short and renew early.
My developer has disappeared and I have no logins. What now?
Start with the domain, since it controls both your website and your email. Find out which registrar holds it and contact them with your business registration documents. The section on who holds the keys walks through the rest.
Do I need to register with the Data Protection Commission?
If your website collects personal data through a contact form, an order form or customer accounts, the Data Protection Act requires you to register as a data controller and keep that registration current. The Data Protection Commission’s site handles registration online.
Most of this is ten minutes a month once it is set up, and the jobs that need a developer come round rarely. If you would rather hand all of it off, see how we work or talk to us. If you are still planning the site itself, start with what every small business website in Ghana should include.
