How to Avoid Website Development Scams in Nigeria

Website projects attract a different kind of problem from larger software builds. The sums are smaller, the buyers are often first-time purchasers, and the assets involved — a domain name, a hosting account, a CMS login — are easy for a dishonest or careless provider to keep.

You do not need technical knowledge to protect yourself. You need to know which accounts must be in your name, what a genuine deliverable looks like, and which promises no honest provider makes.

What website scams look like in Nigeria

Genuine fraud — taking a deposit and disappearing — happens, but it is not the most common loss. Three patterns account for most of the damage:

• Lock-in by account ownership. The provider registers your domain and hosting in their own account, so your business cannot move, renew or edit the site without them.
• Misrepresentation of what was delivered. A ₦600,000 "custom design" that is a purchased template with a logo swapped, or a "website" that is a free-platform subdomain rather than your own domain.
• Abandonment. The provider stops responding after payment, or after the first year, leaving a site nobody can update and renewals nobody can pay.

All three are preventable with arrangements made before money changes hands.

The most common website scams and bad-faith practices

When cheap is the scam: the ₦35,000 website problem

Very low website prices are not always dishonest, but they usually involve a substitution that is not explained.

What an unusually cheap offer often actually is:

• A free or low-cost template with your logo and a handful of text changes
• Hosting on a shared account the provider controls, alongside dozens of other sites
• A domain registered in the provider's name, sometimes a subdomain rather than your own
• No mobile optimisation beyond whatever the template provides
• No contact form testing, no analytics, no backups
• No handover, because there is nothing to hand over

For context, indicative 2026 ranges in the Nigerian market are roughly ₦80,000–₦400,000 for a landing page, ₦150,000–₦500,000 for a basic template or WordPress business site of five to eight pages, and ₦500,000–₦2,500,000 for a professionally custom-designed business site. These are indicative only and vary with scope, vendor and exchange rate.

A price far below those bands is not automatically fraud. It becomes a problem when the buyer believes they are receiving a professional custom site, and discovers a year later that they cannot edit it, move it or renew it without the provider. Ask three questions of any cheap quote: Is the domain registered in my company's name? Will I receive hosting and CMS logins? Is this a template, and which one?

Warning signs before you pay

• The provider offers to "handle everything including the domain" without putting it in your name
• Payment requested into a personal account with no invoice
• No written scope: page count, features, revisions and timeline unspecified
• Guarantees of Google rankings, traffic numbers or sales
• Portfolio shown only as images, with no live links
• Sample sites that are all the same template with different colours
• Refusal to provide a staging link during the build
• Vague or evasive answers about who will hold the logins
• Full payment demanded before you see anything
• Renewal costs not disclosed in writing at the outset

How to verify a web designer or agency is genuine

Website budgets are smaller, so proportionate checks are enough — but do them.

1. Confirm the business identity. For a registered company, ask for the name and RC number and check the Corporate Affairs Commission's public search (https://www.cac.gov.ng/). For an individual freelancer, confirm full name, a verifiable phone number and a consistent professional profile.
2. Ask for three live websites they built, with URLs. Open them on your phone. Check they load quickly, work on mobile and have current content.
3. Contact one client yourself. Take a business from their portfolio, find its phone number on its own site, and call. Ask whether the provider delivered on time, whether logins were handed over, and whether support continued.
4. Check for a real address and working contact channels. A provider reachable only through one Instagram account is a risk you should price into the decision.
5. Ask who does the work if you are dealing with an intermediary reselling someone else's service.
6. Look at how they answer hard questions. "Can you guarantee I will rank first on Google?" A trustworthy provider explains that nobody can guarantee rankings and describes what they can influence instead.

What you are actually buying: domain, hosting, platform and renewals

A website is four separate things, and confusion between them is where most disputes begin.

Indicative 2026 ranges; actual prices vary by provider, extension and exchange rate, and .com domains are priced in US dollars.

Practical rules:

• Register the domain yourself with a registrar account created with your own business email, or require in writing that your company is the registrant and that you hold the account. For .ng domains, use a NiRA-accredited registrar.
• Open the hosting account in your business name and add the provider as a user. This single step prevents most hostage situations.
• Ask what the renewal costs will be in year two, in writing, before you sign.
• Confirm the platform. If the site is built on a proprietary builder with a per-month licence, understand what happens to your site if you stop paying or change provider.
• Diarise renewal dates. Expired domains can be lost or re-registered by others, and recovery is expensive and uncertain.

Payments, deliverables and the handover pack

Staging the payments

Even on a ₦250,000 project, structure matters more than the amount.

Indicative structures only; some providers prefer 50/50, which is also reasonable if the final 50% is genuinely tied to handover.

The principle that protects you: something meaningful remains unpaid until you have the logins in your hand. A provider who insists on full payment before handover is asking you to give up your only leverage.

Ask for a staging link — a temporary URL where you can see the site during the build. It is standard practice, costs nothing, and a refusal is informative.

Proposal and contract terms that protect a small business

You do not need a 20-page agreement. A two-page document covering these points is enough for most SME website projects:

• Scope: number of pages, features included (contact form, blog, gallery, WhatsApp button, booking, payments), and what is excluded.
• Content responsibility: who writes copy, who supplies photographs, and the deadline for each.
• Revisions: how many rounds, and what counts as a revision versus a defect fix.
• Timeline: start date, milestone dates, and what happens if either side causes a delay.
• Payment schedule tied to the stages above.
• Ownership: domain registrant, hosting account holder, and assignment of the design and any custom code to your business on final payment.
• Third-party components: a list of themes, plugins or licences used, with their renewal costs and who pays.
• Handover: an itemised list of what you receive at launch.
• Warranty: a defect-fix period after launch, typically 14–30 days.
• Support and maintenance: whether it is included, for how long, and what it costs afterwards — indicatively ₦20,000–₦150,000 per month or a yearly retainer, depending on the site.
• Termination: what you receive and what you pay if the project ends early.

Keep every agreed change in writing, even if the day-to-day conversation runs on WhatsApp.

The handover pack you must receive

Do not release the final payment until you hold these and have tested them yourself:

• Domain registrar account access, with your business as registrant
• Hosting account login, or cPanel access, in your business name
• CMS or website administrator account in your name, with full rights
• A list of plugins, themes and third-party services, with renewal dates and costs
• Email account setup details if your email uses the same domain
• Google Analytics and Google Search Console access under your own Google account
• Backup arrangement explained, and one backup file you can store yourself
• Design source files, where the contract provides for them
• A short walkthrough showing you how to update text and images
• Written confirmation of what is covered by the warranty period and how to report a fault

Test each login while the provider is still engaged. Credentials that do not work are much easier to resolve before the final payment than after it.

Example (hypothetical): a Benin City boutique's ₦60,000 website

Example (hypothetical). A clothing boutique in Benin City accepts a ₦60,000 offer from a designer found on Instagram, including "free domain and hosting for one year".

Year one goes well enough. The site looks acceptable on a phone and the owner is pleased.

In month thirteen a renewal invoice arrives for ₦185,000. The owner queries it and is told it covers hosting, domain and "maintenance". She asks for the cPanel login so she can move to another host, and is told the account is a reseller package that cannot be split. The domain, it emerges, is registered in the designer's name. When she stops replying, the site goes offline, and the domain her customers have seen on flyers and Instagram for a year is no longer hers to renew.

What ₦8,000 and one decision would have changed: registering the domain herself, in her own registrar account, at the start. She could still have used the same designer, at the same price, with the same template. The provider would simply have been added as a user.

The rebuild costs her an indicative ₦300,000 with a new provider, plus the loss of the domain customers recognised. The most expensive part of a cheap website is rarely the design.

What to do if your website is being held hostage

1. Establish who the registrant is. A public WHOIS lookup will show the registrar and, often, the registrant organisation. This tells you who actually controls the domain.
2. Check what you can still access. Log in to anything you hold — hosting, CMS, email, analytics — and change passwords where you have authority.
3. Take a copy of the site. Export content, download images, and save a copy of the pages before access is lost.
4. Make a written request. Ask formally, by email, for transfer of the domain and hosting accounts, referencing any agreement, invoice or message where ownership was discussed. Keep proof.
5. Contact the registrar. If you paid for the domain and can evidence it, the registrar's dispute process may assist. Requirements vary, and for .ng domains NiRA-accredited registrars have their own procedures.
6. Seek legal advice where the sums or the brand value justify it. A solicitor's letter often resolves what messages cannot.
7. Report suspected fraud to the Nigeria Police Force, or the EFCC where online financial fraud is involved, with your documentary evidence.
8. Plan the fallback. If the domain is genuinely lost, a rebuild on a new domain you control, with redirects impossible and links to update, is painful but recoverable. Start it early rather than waiting months for a resolution.

This is practical guidance, not legal advice. A qualified Nigerian lawyer should advise on your specific circumstances.

What changes for Nigerian businesses

• Instagram and WhatsApp are the sales channel for [web design](/web-design/). Many providers are found through social media, which is normal here. Ask the same verification questions you would of a registered firm, and keep the terms in writing.
• Bank transfers are final. There is no card chargeback to fall back on, which makes staged payments the main protection.
• .com.ng and .ng domains. These are administered through NiRA-accredited registrars. Confirm the registrant details, since a locally registered domain is just as easy to hold in the wrong name.
• First-time buyers are the common target. Business owners buying their first website often do not know that domain, hosting and design are separable. Learning that distinction is most of the defence.
• Price sensitivity is exploited. Very low headline prices are often recovered through renewals. Ask for year-two costs in writing at the quotation stage.
• Ranking guarantees remain a common pitch. No provider controls Google's results. Treat a guarantee as a reason to disqualify, not a selling point.
• Data protection applies to your site too. If your website collects customer details, obligations under the Nigeria Data Protection Act 2023 sit with your business. Ensure your privacy notice reflects reality and check the Nigeria Data Protection Commission's current guidance.

Mistakes to avoid

• Letting someone else register your domain. It is the single most consequential error a Nigerian SME makes online.
• Paying in full before launch. Keep a balance attached to the handover.
• Believing a ranking guarantee. It signals either misunderstanding or dishonesty.
• Not asking whether the design is a template. Templates are legitimate; misrepresentation is not.
• Skipping the staging review. Check the site on your own phone before approving launch.
• Accepting "I will send the logins later". Later frequently becomes never.
• Having no backup you control. If your only copy sits with the provider, you have no fallback.

Conclusion

Website fraud in Nigeria usually turns on ownership rather than theft. Register your own domain, open the hosting account in your business name, insist on a staging link, agree the scope and renewal costs in writing, and hold back a final payment until the logins are in your hands and tested. Those five steps cost nothing and remove almost all the leverage a dishonest or unreliable provider could otherwise hold over your business.

If you would like an existing site reviewed for ownership and access problems, or a new build set up with the domain, hosting and handover arrangements in your own name from day one, Linestech can advise on how a clean website engagement should be structured.

Frequently asked questions

How do I check whether my domain is registered in my name?

Run a public WHOIS lookup for your domain. It shows the registrar and often the registrant organisation, though some details may be hidden for privacy. If the registrant is not your business, ask your provider for the registrar account details and request a transfer. Do this while the relationship is good, not during a dispute.

Is it normal for a web designer to hold my hosting account?

It is common, and it is where most problems begin. Better practice is a hosting account in your business name with the provider added as a user. Many Nigerian hosts and international providers support additional users, so there is no technical reason for the account to sit in someone else's name.

What if my developer disappeared but I still have the website?

Secure it immediately. Change the administrator passwords you control, check the domain and hosting account details, take a full backup, and confirm when renewals fall due. Then engage another developer to review the site, remove any access you cannot identify, and document what you have. This is usually straightforward if you own the accounts.

Can I move my website to a new developer?

Yes, provided you control the domain, the hosting and the site's administrator account. A new developer can take over an existing site, or migrate it elsewhere. Where the site was built on a proprietary builder tied to the original provider's licence, migration may mean rebuilding, which is a reason to ask about the platform before you buy.

How much should a real business website cost in Nigeria?

Indicatively, ₦80,000–₦400,000 for a landing page, ₦150,000–₦500,000 for a basic five to eight page business site, and ₦500,000–₦2,500,000 for a professionally custom-designed site, with e-commerce from around ₦400,000 upwards depending on catalogue and integrations. These are indicative 2026 ranges only; compare two or three written quotations on the same scope.

Should I sign a contract for a small website project?

Yes, even a two-page one. It should state scope, revisions, timeline, payment stages, ownership of the domain and design, the handover list and what happens if either side withdraws. Small projects generate disputes just as often as large ones, and there is usually less documentation to rely on.

What should I do before the final payment?

Test every login yourself, check that the site is on your own domain, submit a test message through every form, view the site on a phone on mobile data, confirm analytics is connected to your own Google account, and take a backup you store independently. Release the final payment once all of that works.

Sources and further reading

Figures, platform rules and regulations change. These are the primary references behind this article and the places to check before you act on it.

• Corporate Affairs Commission (CAC)
• Nigeria Data Protection Commission (NDPC)
• Nigeria Internet Registration Association (NiRA)
• Cloudflare Learning Center
• GitHub documentation