If you run a business website, a blog or an online shop on WordPress, this one needs your attention today. The US Cybersecurity and Infrastructure Security Agency (CISA) added a WordPress core vulnerability, tracked as CVE-2026-119977, to its Known Exploited Vulnerabilities (KEV) catalogue on 3 November 2026, citing evidence of active exploitation. The fix has been available since 28 October, so the job now is to make sure every site you are responsible for actually has it.

This article is for website owners, web designers who manage client sites, and the IT staff at small businesses who keep the company site running.

What the flaw is and why it is unusual

Most WordPress attacks go after plugins or weak passwords. This one targets WordPress core itself, and it strikes at an unexpected moment: while the site is updating.

When WordPress installs a core update, it unpacks the new release into a temporary staging folder under wp-content/upgrade before moving files into place. On affected versions, those temporary files can be reached from the web for the short time the update is running. That briefly exposes a spare copy of the WordPress installer. An attacker who reaches it before WordPress cleans up could point that staged installation at a database they control, opening a route to running code on the server.

Security researchers describe it as a race condition. No login and no user interaction are needed, but the timing is tight: in Wordfence’s lab tests the window normally lasted only seconds. Wordfence scores the flaw 8.1 (High) on the CVSS scale, while WordPress itself rated it Low. CISA’s decision to list it as exploited is the clearest signal that attackers think the race is worth running.

What attackers are doing

Wordfence pushed a firewall rule for the bug on 28 October and recorded its first match nine minutes later. Reports since then describe large volumes of requests aimed at staged installer paths, especially setup-config.php files under wp-content/upgrade. Researchers stress that blocked requests are scanning, not proof that a site was taken over, and CISA has not named the attackers or said how many sites were compromised.

Which versions are affected and which fix it

The flaw affects WordPress 4.7 through 7.1.3. The main fix is WordPress 7.1.4, and WordPress back-ported fixes to older branches as well. Examples of the fixed versions per branch include:

• 7.1 branch: 7.1.4
• 7.0 branch: 7.0.8
• 6.9 branch: 6.9.11
• 6.8 branch: 6.8.12
• 6.7 branch: 6.7.11
• Oldest covered branch, 4.7: 4.7.39

WordPress 4.6 and older get no fix at all, and WordPress only actively supports its latest release, so moving to 7.1.4 is the best choice where your theme and plugins allow it.

The 7.1.4 release also fixes other issues, including stored cross-site scripting problems, a stored denial-of-service bug in the Interactivity API, and a leak of unpublished Customizer changes. It also updates the bundled root certificates after the recent eMudhra distrust.

Why “auto-update” is not enough on its own

Many sites receive minor core updates automatically, but background updates can be disabled by hosts, by settings in wp-config.php, or simply fail. Do not assume. Confirm the version number on every site.

Who should worry most in Nigeria and Africa

WordPress powers a large share of small-business, NGO, school and media websites across the continent, often on shared hosting managed by a freelancer or an agency. Those setups are exactly where updates get missed: the person who built the site may have moved on, auto-updates may be switched off to “avoid breaking things”, and nobody is reading the server logs. Agencies that look after dozens of client sites should treat this as an inventory exercise, not a single click.

How to check and fix your site

1. Confirm your version

In the WordPress dashboard, open Dashboard > Updates. The page shows your current version and offers the security release if it is missing. If you use WP-CLI, the command wp core version shows the installed version, and wp core update installs the newest release.

2. Block web access to the staging folder

Until every site is patched, and as a lasting safeguard, block public access to wp-content/upgrade. Put the rule in your main web server configuration or the site’s root .htaccess, not inside the upgrade folder, because WordPress empties that folder during updates. On Apache a rewrite rule that returns “Forbidden” for that path works; on Nginx a location block with deny all does the same. Ask your host to do this if you cannot.

3. Check your logs

Ask your host for web server access logs, not just WordPress logs, and look for requests to PHP files under /wp-content/upgrade/, especially setup-config.php. WordPress never requests that folder over the web, so such requests are suspicious. A successful (200) response close to the time of one of your core updates deserves urgent follow-up.

4. Look for signs of compromise

After updating, review administrator accounts for anyone you do not recognise, check for plugins you did not install, and look for unfamiliar PHP files changed since 28 October. If you use WP-CLI, wp core verify-checksums compares core files with the official release. If anything looks wrong, treat the site as compromised: keep the evidence, restore from a known-good backup, and change the database password, security salts and admin passwords.

What you should do

• Today: update every WordPress site to 7.1.4, or at least the fixed version for its branch, and confirm the version number afterwards.
• Block web access to wp-content/upgrade at the server level.
• Review access logs and admin accounts for anything unusual since late October.
• Keep a web application firewall as an extra layer, but never as a replacement for patching.
• Remember plugins and themes are separate: this release fixes core only, so update those too.

Sources

• CISA Warns of WordPress Core Vulnerability Exploited in Attacks (Cybersecurity News)
• WordPress CVE-2026-119977: Patch, Check and Detect (Ciphers Security)
• WordPress 7.1.4 Security Update (Brandefense)
• CISA Confirms Hackers Exploiting WordPress Core Flaw During Software Upgrades (The Hacker News)

Read and share the original on Mosravo Endless Solutions Publications

Many small and mid-sized organisations run their entire online presence through one company and one login: the domain is registered with a host, the website sits on that host’s server, email runs on the same machine, and the DNS is edited from the same control panel. It is convenient and cheap. It is also a single point of failure. If an attacker gets into that one account, or that one server, they can take your website, read or redirect your email, and even obtain valid security certificates in your name.

This article is for business owners, IT managers, web developers and anyone responsible for a company’s domain, website or email. It explains why separating your domain registrar, DNS, web hosting, mail servers and external proxy layer is one of the most effective and least glamorous ways to strengthen your defences, and how to do it step by step without breaking anything.

Key takeaways

• Your domain registrar account is the master key. Whoever controls it can change where your website and email point. Protect it more carefully than any single server.
• Segregation limits the blast radius. If your web host is compromised, a separate registrar, DNS provider and mail service mean the attacker does not automatically get everything else.
• Running web and mail on the same server can expose your real server address and undo the protection of a reverse proxy or content delivery network.
• Separation only works with strong account security: multi-factor authentication, registrar locks, auto-renewal and monitoring of DNS records and certificate logs.
• Your organisation, not a web designer or hosting company, should own the domain, in an account tied to a company email address.

The four layers: what each one does

Before deciding how to separate things, it helps to be clear about what each layer controls.

Domain registrar

The registrar is the company you pay to register your domain name, for example a .com or .com.ng name. The registrar account decides which name servers are authoritative for your domain. Change those, and you change who answers for your entire domain on the internet.

DNS hosting

DNS records translate your domain into addresses: A and AAAA records for your website, MX records for your email, TXT records for email authentication and verification, and CNAME aliases for services. DNS can be hosted by your registrar, your web host, a dedicated DNS provider or your own servers.

Web hosting

The server or platform that actually serves your website and applications. This is the layer most exposed to attack, because it runs code such as a content management system, plugins and databases that face the internet all day.

Mail servers

The systems that send and receive your email. Email carries invoices, password reset links and confidential conversations, which makes it a prime target for fraud.

External proxy servers

A reverse proxy or content delivery network sits in front of your website. Visitors connect to the proxy, which filters malicious traffic, absorbs denial-of-service floods and forwards clean requests to your real server, known as the origin. The proxy only protects you if attackers cannot find and reach the origin directly.

Why putting everything in one place is risky

One stolen password can take everything

The US Cybersecurity and Infrastructure Security Agency (CISA) issued Emergency Directive 19-01 after a wave of DNS hijacking against government domains. It described how attackers obtained credentials for accounts that could change DNS records, then altered A, MX and NS records to send web and mail traffic through infrastructure they controlled. Because they controlled the DNS, they could also obtain valid certificates for the affected domains, letting them decrypt redirected traffic without browser warnings. CISA noted that the risk persisted even after the redirection ended.

Now imagine that the same login also controls your hosting server and your mailboxes. A single phishing email to the person who manages “the website” could hand an attacker your domain, your website files, your email archive and the ability to send convincing fraudulent invoices from your real address.

Shared servers leak your real address

Cloudflare’s documentation warns that when a website and email run on the same physical server, the DNS records for mail usually cannot be proxied. Anyone who looks up those records can discover the origin server’s real IP address and attack it directly, bypassing the proxy’s protections. Cloudflare also notes that bounce messages sent when someone emails a non-existent address can reveal the mail server’s IP. Its advice is not to host mail on the same server as the protected web resource, and to use non-contiguous IP addresses from different ranges.

Your hosting company may effectively own your domain

The UK National Cyber Security Centre (NCSC) advises organisations to make sure they, and not a web hosting company, control their domains, and to move domains registered with personal email accounts onto the organisation’s own systems. This is a very common problem across Nigeria and the wider continent, where a freelance developer or hosting reseller registered the domain years ago in their own account. If that relationship ends badly, or the developer’s email is compromised, the business can lose its name overnight.

What segregation looks like in practice

Segregation does not mean buying expensive enterprise products. It means each critical function lives with a provider and account chosen for that job, so a failure in one does not cascade into the others.

A sensible model for a small or mid-sized organisation

• Registrar: a reputable registrar that supports two-step verification and registrar lock, holding only domain registrations. Nobody logs in except to renew or change name servers.
• DNS: either the registrar’s DNS or a dedicated DNS provider, managed by a small number of named administrators with multi-factor authentication and change logging.
• Web hosting: your server or platform, with its own separate credentials. Ideally the hosting account has no power over the domain registration.
• Email: a dedicated email service or a mail server on separate infrastructure, not the same box as the website.
• Proxy: a reverse proxy or CDN in front of the website, with the origin locked down so it only accepts traffic from the proxy.

Benefits you gain

• Containment: a hacked WordPress plugin on your web server does not give the attacker your email or your domain.
• Resilience: if your web host suffers an outage, email keeps flowing; the NCSC notes that combining DNS hosting options adds resilience against outages and denial-of-service attacks.
• Clear accountability: each layer has named owners, and access can be granted on a least-privilege basis.
• Easier migration: moving to a new web host is a matter of changing a few records, not untangling domain ownership.

Costs and trade-offs

More providers means more accounts to secure, more renewals to track and slightly more complex troubleshooting. That is manageable with a simple inventory and a password manager, and the trade is usually worth it for any organisation whose income depends on its website or email.

Step-by-step: how to separate your services safely

Plan changes during a quiet period, lower DNS record TTL values a day or two before moving anything so changes take effect faster, and keep a written rollback plan.

1. Build an inventory. List every domain you own, the registrar, who has the login, where DNS is hosted, where the website and mail run, and when each domain expires.
2. Take ownership of your domains. Make sure each domain is registered to the organisation, with contact details on a role-based company address such as domains@yourcompany. The NCSC also advises keeping documents that prove ownership, in case you ever need to reclaim a hijacked domain.
3. Secure the registrar account. Turn on two-step verification for every administrator, use a long unique password stored in a password manager, and ensure more than one trusted person can manage the account so you are not locked out if someone leaves.
4. Apply registrar lock. A registrar lock is a status that tells the registry to block transfers and deletions while it is active; renewals still work. For high-value domains, ask whether your registrar offers stronger registry-level locking, which the NCSC suggests weighing against its cost.
5. Turn on auto-renewal. Use a company-maintained payment method so a domain never lapses and gets snapped up by someone else.
6. Move email off the web server. Migrate mailboxes to a dedicated mail service or separate server, update MX records, and set up SPF, DKIM and DMARC for the new provider.
7. Put a proxy in front of the website. Point the website’s records through the proxy and confirm every record that can be proxied is proxied.
8. Hide and protect the origin. Following Cloudflare’s guidance, consider changing the origin’s IP address after moving behind a proxy, because historical DNS records are public. Review DNS-only records such as FTP or SSH entries that might reveal the origin, and configure the server’s firewall to accept web traffic only from the proxy’s published address ranges.
9. Separate credentials and roles. The person who updates website content should not need registrar access. Remove old staff, former agencies and unused accounts at every layer.
10. Clean up old records. Remove delegations and CNAME aliases pointing to services you no longer use. The NCSC warns that forgotten aliases can lead to subdomain takeover.

Monitoring: how to spot trouble early

Separation reduces damage, but you still need to know quickly when something changes.

• Watch critical DNS records. The NCSC recommends monitoring name server, MX and other service-critical records for unexpected changes, and logging all DNS changes. CISA’s directive likewise ordered agencies to audit their DNS records, prioritising NS and MX records.
• Monitor certificate transparency logs. Every publicly trusted certificate is recorded in public logs. A certificate for your domain that you did not request can be an early sign of DNS compromise, a check both CISA and the NCSC recommend.
• Check blocklists. If your domain or mail server appears on a DNS blocklist, it may indicate abuse such as spam sent from a compromised account.
• Enable registrar and DNS alerts. Most providers can email you when records, contacts or locks change. Send these to a monitored team address, not one person’s inbox.

Common mistakes to avoid

• Leaving the domain in a developer’s or reseller’s personal account.
• Using the same password, or the same email address that receives password resets, across registrar, DNS, hosting and email.
• Relying on SMS codes alone; CISA recommends phishing-resistant methods such as security keys and advises against SMS for DNS accounts.
• Putting a proxy in front of a site while leaving the origin open to the whole internet.
• Forgetting that the registrar’s own password reset emails go to a mailbox that may itself be hosted on the server you are trying to protect.

Frequently asked questions

Is this overkill for a small business?

No. The basics, owning your domain, turning on two-step verification and registrar lock, and running email separately from the website, cost little and prevent some of the most damaging incidents a small business can face.

Can I use one provider for several layers?

Yes, if each layer uses separate, well-protected access and the provider is reputable. The goal is to avoid one compromised login or server controlling everything, not to collect providers for their own sake.

Should I enable DNSSEC?

DNSSEC adds protection against forged DNS answers, but the NCSC advises weighing its costs and benefits first, as it adds key-management work and not every service supports it.

Next steps

• This week: list every domain, registrar, DNS host, web host and mail service you use, and who holds each login.
• Turn on two-step verification and registrar lock for every domain, and switch on auto-renewal.
• Move any domain held in a personal or agency account into a company-owned account.
• Plan to move email off your web server if they currently share a machine.
• Set up alerts for DNS changes and new certificates issued for your domains.
• Review the setup every six months, and whenever staff or suppliers change.

Sources

• NCSC: Managing public domain names
• CISA Emergency Directive 19-01: Mitigate DNS Infrastructure Tampering
• Cloudflare: Exposed IP addresses
• Cloudflare: Protect your origin IP
• Web4Africa: What is registrar lock?

Read and share the original on Mosravo Endless Solutions Publications

If you run a business website in Nigeria, you have probably noticed that the renewal notice for your domain name rarely shows the same figure twice. Sometimes the change comes from the registry that runs the extension, sometimes from your registrar, and sometimes from the naira exchange rate. This explainer is for business owners, IT officers and freelancers who manage domains for clients and want to understand why prices move, how long the changes are likely to continue, and what they can do to keep costs predictable.

Key takeaways

• The wholesale price of a .com domain rises by 7% on 1 November 2026, from US$10.26 to roughly US$10.98 before registrar fees, according to registrar reports.
• The contract between Verisign and ICANN allows up to 7% increases in four of every six years, so further rises are possible each year until about 2030.
• .ng prices have moved both ways: a cut of about 40% in 2022, then a registry increase in February 2025.
• For Nigerian buyers of .com, the naira exchange rate can matter as much as the dollar price.
• Renewing early, consolidating domains and reviewing which names you still need are the most practical ways to control costs.

Who actually sets the price of a domain name?

A domain name passes through three layers before it reaches you, and each layer can change the price.

The registry

Every extension has one registry operator that keeps the master database. Verisign runs .com. The Nigeria Internet Registration Association (NiRA) runs .ng and its second-level options such as .com.ng and .org.ng. The registry charges a wholesale fee for each year a name is registered.

The registrar

Registrars are the companies you actually buy from, such as local hosting firms or international registrars. NiRA works on what it calls a 3R model (Registry, Registrar, Registrant), which means it does not sell directly to the public and does not publish its wholesale prices. Registrars add their own margin, payment processing costs and, for generic extensions like .com, a small ICANN fee.

The registrant (you)

You pay the retail price. Because registrars often sell close to cost, as the registrar Porkbun notes in its own explanation, a wholesale increase is usually passed straight on to customers at the next renewal.

The .com price battle: what is changing on 1 November 2026

The .com extension is the most widely used in the world, and its pricing is governed by an agreement between Verisign and ICANN, the body that coordinates the domain name system.

A short price history

According to figures published by the registrar Openprovider, the .com wholesale price was frozen at US$7.85 from January 2012 until August 2021. It then rose each year: US$8.39 in September 2021, US$8.97 in 2022, US$9.59 in 2023 and US$10.26 in September 2024. There was no increase in 2025.

The 2026 increase

Verisign’s next 7% increase takes effect on 1 November 2026. Industry reporting by WebHosting.Today describes it as the first step in a four-year pricing cycle, and 7% on US$10.26 brings the wholesale price to roughly US$10.98. Registrars then add their own fees, so the retail price you see will be higher. Porkbun, for example, told customers to expect about US$11.81 at its checkout after the change.

Why the rises can continue

The Verisign and ICANN agreement allows the registry to raise the maximum price by up to 7% in four of every six years. Openprovider says the current six-year window runs to November 2030 and that up to three more increases are permitted after this one. If every allowed increase is taken, analysts estimate the wholesale price could reach roughly US$13.40 to US$13.45 by the end of the cycle. That is a ceiling, not a forecast; Verisign has skipped increases before, as it did in 2025.

The .ng story: cuts, rises and new proposals

Nigeria’s own extension has followed a different path, shaped by local policy goals rather than a single contract.

The 2022 price cut

In early 2022 NiRA announced a review of .ng pricing from 1 March, with a discount of around 40% on second-level .ng names. Its then president explained that pricing was the main barrier to adoption because Nigerian buyers are price-sensitive. At the time, Technology Times found registrars listing .ng at roughly ₦8,500 to ₦12,000 and .com.ng mostly between ₦899 and ₦1,500.

The 2025 increase

Registry prices rose again on 1 February 2025. The Rio Times reported that by 2026 registrars were listing .ng at around ₦15,000 and .com.ng at around ₦7,000, while a February 2026 pricing guide showed .ng at ₦13,000 and third-level names at ₦6,000 before 7.5% VAT. Registrars also run promotions; Whogohost, for example, advertised .com.ng from ₦3,000 and .ng from ₦9,200 during a time-limited offer in March 2026. Always check what the renewal price will be after any first-year discount ends.

What NiRA is proposing now

In August 2026, The Rio Times reported several policy directions from NiRA. These are proposals, not final changes:

• SME bundles that combine a .com.ng name with basic hosting and a simple website through accredited registrars.
• Vouchers that would subsidise wholesale fees for small firms through agencies such as SMEDAN and the Bank of Industry.
• A trademark notification service that alerts brand owners when similar names are registered under .ng, .com.ng and .org.ng.
• Pressure for an executive order requiring government agencies to use .ng.

NiRA has also said Nigeria loses about ₦60 billion a year to foreign domain registrations, which helps explain why it wants local names to be more attractive.

Why domain prices keep changing

Pulling these threads together, five forces explain most of the movement you see on your invoices.

1. Registry contracts. For .com, the ICANN agreement sets how often and how much prices may rise. As long as that clause stays, small annual increases remain possible.
2. Policy goals. NiRA has cut prices to boost adoption and raised them when its costs or strategy changed. Proposed vouchers and bundles could lower the effective cost for small firms again.
3. Exchange rates. Dollar-priced extensions like .com are billed in dollars at the wholesale level. When the naira weakens, the naira price rises even if the dollar price does not. The Rio Times calculated its 2026 conversions at about ₦1,357 to the dollar, far from the ₦416 rate it used for 2022.
4. Registrar strategy. Registrars use cheap first-year deals to win customers and recover margin on renewals. This is why the price you paid once is not the price you pay forever.
5. Taxes and fees. VAT on local purchases and card processing fees on international ones add to the base price.

How long will prices continue to change?

No one can give an exact date, but the sources point to a few reasonable expectations.

• .com: Under the current contract, further increases of up to 7% a year are allowed until around 2030. Whether Verisign takes each one is its decision, but the direction is upward, not downward. Porkbun’s own advice is blunt: the .com price can only increase.
• .ng: Prices depend on NiRA’s policy choices. If the SME vouchers and bundles go ahead, small businesses may see lower effective costs, but no start date or price has been announced.
• The naira factor: For any dollar-priced extension, your local cost will keep tracking the exchange rate.

In short, expect change to be normal rather than occasional. Planning for it is cheaper than reacting to it.

Practical ways to control your domain costs

1. Audit your domain list

List every domain your business owns, its extension, the registrar, the expiry date and whether auto-renew is on. Many organisations pay for old campaign names or typo domains they no longer need.

2. Decide whether to renew early

Renewals completed before 1 November 2026 are charged at the old .com price, and early renewal adds time from your current expiry date without wasting time already paid for. Porkbun notes you can renew up to 10 years ahead. For an individual business with a few important names, locking in several years can make sense. Openprovider points out that for large portfolios it only pays off if you are confident you will keep the names, so weigh the saving against the risk of paying for domains you later drop.

3. Compare renewal prices, not first-year prices

When choosing a registrar, ask for the standard renewal price and any transfer fees. A cheap first year followed by a steep renewal is a common trap.

4. Consider your extension strategy

If most of your customers are in Nigeria, a .ng or .com.ng name can be cheaper to keep, is paid in naira and signals a local presence. Many businesses keep both: a .com.ng for local trust and a .com to protect the brand internationally.

5. Protect the names that matter

Turn on auto-renew for your main domain and keep a valid payment method on file. Losing a domain because a card expired can cost far more than any price increase. Also check that your registrar supports security features; The Rio Times reported that only 15 of 164 accredited .ng registrars had adopted DNSSEC.

Frequently asked questions

Will my .com price go up even if I registered years ago?

Yes. Increases apply at renewal, regardless of when you first registered. Only years you have already paid for are protected.

Is .ng cheaper than .com?

It depends on the registrar and the exchange rate. Third-level names like .com.ng are generally among the cheapest options, while second-level .ng names are priced higher. Compare current quotes in naira.

Can a registrar charge more than the registry increase?

Registrars set their own retail prices, so yes. That is why comparing renewal prices across accredited registrars is worth doing every few years.

Does NiRA sell domains directly?

No. NiRA works through accredited registrars, which handle sales and support.

Next steps

• Before 1 November 2026, check which of your .com domains expire in the next year and decide whether to renew them early.
• Build a simple domain register with expiry dates, registrars and owners, and review it twice a year.
• Budget for small annual increases on .com until at least 2030, and add a buffer for exchange-rate movement.
• Watch for NiRA announcements on SME bundles and vouchers if you run a small business.
• Keep auto-renew on for your core domains so a price change never becomes a lost website.

Sources

• Openprovider: What the .com price increase in 2026 means for your domain portfolio
• Porkbun: Why did .com prices go up and how high will they go?
• WebHosting.Today: Verisign starts a four-year .com price cycle
• The Rio Times: NiRA pushes cheaper .ng domain costs and trademark alerts
• Technology Times: Nigeria to cut .ng domain prices by 40%
• Techeconomy: Whogohost .com.ng and .ng domain promotion

Featured image: Photo: “computer keyboard” by abegum, CC BY 2.0, via Openverse — source

Read and share the original on Mosravo Endless Solutions Publications

This explainer is for Nigerian business owners, web developers, IT managers and public institutions who depend on a local web host or a .ng domain registrar. It looks at why trust in parts of the market remains fragile, what the evidence shows, what sits behind the problems, and what customers, providers and regulators can do about it.

Key takeaways

• The .ng namespace is growing but remains small: about 249,897 domains were under management at the end of July 2026, far below the one million target NiRA set in 2019.
• Avoidable domain deletions have been eating into growth. For the first five months of 2026, deletions were equal to more than half of new growth.
• Only 15 of 164 accredited registrars (about 9%) had DNSSEC-enabled domain management in mid-2026, a weak point for security.
• Well-publicised failures, such as sites that stayed offline after customers renewed hosting in 2025, damage confidence in the whole local market.
• High energy costs, foreign-exchange pressure and thin margins make reliable hosting expensive to deliver in Nigeria.
• New data localisation rules mean more data must live in Nigeria, which raises the stakes for getting local hosting right.

What is going wrong in the market

Not every Nigerian host or registrar is failing. Several providers run solid services, and some have invested heavily in better infrastructure. But customers keep reporting the same pattern of problems, and those problems shape how the whole sector is seen.

Downtime and slow support

The most damaging complaints are about sites going offline and support teams going quiet. In August 2025, customers of the Nigerian host HostNowNow reported that websites stopped working after they renewed their hosting. One developer said two sites he managed stayed inaccessible despite repeated contact, and a media and IT firm said it eventually moved a client’s site to another provider and even changed the domain extension. The company acknowledged “internal operational issues”, explained that some processes had moved from automated systems to manual handling, and promised refunds and apologies. Later reports said some customers did receive refunds after the complaints became public.

The pattern is familiar. Developer accounts going back years describe support tickets left unanswered for days, slow page loads and unexplained outages. Those stories travel fast in Nigeria’s developer communities and push many technical buyers towards foreign providers by default.

Lapsed and deleted domains

NiRA’s own figures point to a retention problem. Its July 2026 Registrar Ecosystem Update recorded 5,646 deletions in July, the lowest monthly figure of the year. Even so, deletions equalled almost a third of growth that month, down from 42.7% in June and above 50% in each of the first five months of 2026. NiRA describes many of these losses as avoidable. In practice, a deleted domain often means a business forgot to renew, never received a reminder, or did not control the account its domain sat in.

Weak security basics

DNSSEC protects visitors from forged DNS answers that can redirect them to fake sites. NiRA has implemented DNSSEC at the registry level, but the same July 2026 update found that only 15 of 164 accredited registrars, about 9.15%, offered DNSSEC-enabled domain management. For a country where phishing and impersonation are daily problems, that is a large gap.

Slow growth of the national namespace

In 2019, NiRA set a goal of one million active .ng registrations within five years. By mid-2026 it reported about 241,000 active domains, rising to just under 250,000 by the end of July. Growth has picked up in 2026, but the namespace is still a fraction of the target, and many Nigerian businesses and institutions continue to use foreign extensions.

Why it matters

A website is now a shop front, a payment page and a customer service desk. When it goes down, the cost is immediate.

• Lost revenue and leads: visitors who find a dead page rarely come back.
• Reputation damage: customers blame the business, not the host.
• Search ranking losses: slow or frequently unavailable sites are harder for search engines to crawl and index.
• Security exposure: expired domains can be re-registered by others, and poorly maintained servers are easy targets.
• National capacity: every customer who gives up on local providers takes spending, jobs and skills offshore.

The money involved is not trivial. As far back as 2017, NiRA’s then president estimated that hosting .ng sites abroad cost Nigeria up to N60 billion a year in lost value, and a 2013 study by Gigalayer found that more than 90% of websites owned by Nigerians were hosted outside the country. Those figures are old, but they show how long the problem has persisted.

What sits behind the problems

Energy costs

Running servers around the clock needs constant power and cooling. Grid electricity now reflects full market tariffs, diesel is no longer subsidised, and self-generated diesel power is reported to cost between US$0.28 and US$0.33 per kWh. For many Nigerian data centre operators, energy is said to account for more than 35% of operating expenses. Smaller hosts that rent space or run their own racks feel these costs most, and cutting corners on power and cooling shows up as downtime.

Heat is a real risk even for large operators. On 8 October 2026, the NCC’s incident board linked a major MTN network disruption across parts of Lagos, Oyo, Rivers, Delta and the FCT to high temperature at an MTN data centre. It is a reminder that resilient facilities need serious, well-maintained cooling and backup.

Foreign exchange and pricing pressure

Much of what hosts buy, from server hardware to software licences and international bandwidth, is priced in dollars. When the naira weakens, costs rise faster than providers can raise prices in a highly price-sensitive market. The result is often a race to the bottom: very cheap plans, overloaded shared servers and thin support teams.

Scale and skills

Many hosting firms are small businesses reselling capacity bought elsewhere. They may lack round-the-clock engineers, documented processes or automated billing and provisioning. The HostNowNow case showed how quickly service suffers when automated systems give way to manual work.

Low switching costs, low accountability

Customers who are unhappy often simply leave, frequently for a foreign provider, rather than complain formally. Without published uptime figures, independent reviews or clear service-level agreements, weak providers face little pressure to improve.

The case for change, and what is already moving

There are signs of progress. NiRA launched a new online Registrar Accreditation Platform in 2025 to make onboarding faster and more transparent, and 23 new registrars were accredited in 2024. It reports stronger retention in 2026, with combined new registrations and renewals of 17,810 in July, the highest monthly total of the year. NiRA has said it will push multi-year registrations, renewal reminders and wider use of second-level domains, and work with NITDA to make .ng and .gov.ng the preferred choice for institutions.

Regulation is also changing demand. NITDA’s data classification framework says sensitive data in finance, healthcare and government must be stored in Nigeria, and the CBN has directed that payment transaction data be stored locally by 1 January 2027. Investment is following: one market estimate cited by Nairametrics projects Nigeria’s data centre market to grow from about US$374 million in 2026 to about US$783 million in 2031.

That creates an opportunity and a test. If more regulated data has to stay at home, Nigerian hosting has to be dependable. A market where customers fear losing their site after renewal cannot carry that load.

What good looks like

• Published service levels: clear uptime commitments, support response times and compensation when they are missed.
• Customer ownership of domains: domains registered in the customer’s name, with the transfer code available without delay.
• Automated renewals and reminders: several expiry notices by email and SMS, and grace periods explained up front.
• Security by default: DNSSEC offered at every registrar, free TLS certificates, patched server software and two-factor authentication on control panels.
• Backups customers can download: regular, tested backups stored separately from the main server.
• Resilient power and cooling: redundant power, enough cooling capacity and honest status pages during incidents.

How to protect your business now

You do not need to wait for the industry to improve. Whether you use a local or foreign provider, these steps reduce your risk.

1. Confirm you own your domain. Log in to your registrar account and check that the registrant name and email are yours, not your web designer’s.
2. Turn on auto-renew and renew for several years. Add a calendar reminder 60 days before expiry as a backup.
3. Keep your own backups. Download a full copy of your site files and database at least monthly and store it away from the hosting server.
4. Use an independent uptime monitor. Free services can email you when your site goes down, so you are not relying on customers to tell you.
5. Ask for DNSSEC and two-factor authentication. If your registrar cannot offer them, consider one that can.
6. Document support contacts. Keep tickets, emails and payment receipts. They matter if you need a refund or escalate a dispute.
7. Have a migration plan. Know how to move your files, database and DNS records to another host quickly if service fails.
8. Check data rules. If you handle payment, health or government data, confirm where your provider stores it and whether that meets current localisation requirements.

Frequently asked questions

Should I avoid Nigerian hosting companies altogether?

No. Some local providers are reliable, and hosting close to your users can reduce latency and make naira payment easier. Judge each provider on service levels, support response, backups and reviews rather than on location alone.

What happens if my .ng domain expires?

An expired domain can be deleted and become available to anyone. Renew early, use auto-renew, and make sure renewal notices go to an email address you check.

What is DNSSEC and do I need it?

DNSSEC adds digital signatures to DNS records so visitors are not silently sent to a forged address. It is especially valuable for banks, fintechs, online shops and any brand that is often impersonated.

Where can I complain about a registrar?

Start with the registrar’s support channel and keep records. If a .ng registrar does not resolve the issue, you can raise it with NiRA, which accredits registrars for the .ng namespace.

Next steps

For businesses, spend thirty minutes this week checking domain ownership, renewal dates, backups and monitoring. For hosts and registrars, publish real service levels, automate renewals and switch on DNSSEC and two-factor authentication by default. For regulators and industry bodies, independent reporting of uptime and complaints would help good providers stand out. Nigerian hosting can earn the trust the data localisation era demands, but only if reliability becomes the norm rather than the exception.

Sources

• Techeconomy: .ng domain registrations near 250,000 (NiRA July 2026 update)
• Nairametrics: NiRA records 241,000 active .ng domains
• What happened to HostNowNow? What website owners should know
• Nairametrics: Nigeria's data centres, power and water
• Techpoint Africa: NITDA data classification framework and local hosting
• BusinessDay: Nigeria's local web hosting market

Featured image: Photo: "17° Server Room @ Work" by Leonardo Rizzi, CC BY-SA 2.0, via Openverse — source

Read and share the original on Mosravo Endless Solutions Publications

When a customer in Lagos opens your website, or a staff member in Abuja sends a file to a colleague in Port Harcourt, where does that data actually travel? The answer is often surprising. Depending on how networks are connected and where content is hosted, traffic between two points in the same country can travel out to servers abroad and back again. That adds delay, depends on international links, and can add cost for the network operators that carry it.

Keeping more of that traffic local is the central theme of the 2026 Nigerian Peering and Interconnection Forum (ngPIF), scheduled to hold in Lagos on 28 and 29 October 2026. The forum is organised by the Nigerian Network Operators Group (ngNOG) together with the Internet Exchange Point of Nigeria (IXPN) and the Nigerian Communications Commission, and brings together telecom operators, internet service providers, data centre companies, regulators and technology firms.

This might sound like a conversation for network engineers only, but the outcome affects every business that depends on the internet. Here is a plain-language guide.

Peering and IXPs in plain language

Peering is an arrangement in which two networks exchange traffic directly with each other, rather than paying a third party to carry it. An internet exchange point (IXP) is shared infrastructure where many networks connect so they can exchange traffic in one place.

When your internet provider and the network hosting a website you visit both connect at a local IXP, the traffic between them can stay in the country. Where networks have the right connections and commercial arrangements, keeping eligible traffic local can reduce reliance on international transit, lower latency (the delay you feel when a page loads or a call connects) and improve resilience if an international link has problems.

Speaking ahead of the forum, ngNOG’s convenor argued that Nigeria needs to pay closer attention to the infrastructure and interconnection arrangements behind its growing digital economy, and that no single player can solve the challenge alone. The priorities he outlined include keeping more traffic local, strengthening peering, developing local data centres and content hosting, and improving cooperation between operators, content providers, regulators and IXPs.

What local routing can and cannot do

It is worth being realistic. The benefits of peering depend on how much traffic is genuinely local, the capacity of domestic infrastructure, where content is hosted and the commercial deals between networks. Organisers have also been clear that local traffic exchange alone cannot guarantee cheaper retail internet, because data prices also reflect spectrum costs, energy, equipment, taxes, competition and other operating expenses.

Local interconnection also does not replace international connectivity. Businesses will still need reliable international links to reach overseas websites, global cloud platforms and services hosted abroad. The goal is a better balance, not isolation.

Why this matters for your business

• Speed for local customers: if most of your customers are in Nigeria, content served from within the country can load faster for them.
• Better real-time services: voice calls, video meetings, POS transactions and online payments are sensitive to delay and interruptions.
• Resilience: traffic that stays local is less exposed to problems on international routes, such as damage to undersea cables.
• Data location: keeping data in-country can help businesses that must meet data protection or sector requirements about where information is stored, though you should always check the specific rules that apply to you.

Practical steps SMEs can take now

1. Ask your ISP about peering. When choosing or renewing an internet service, ask whether the provider connects to IXPN or other local exchange points. A provider that peers locally is likely to give better performance for local services.
2. Think about where your website is hosted. If your audience is mainly in Nigeria, compare local or regional hosting with overseas hosting. Measure load times from a local connection before deciding.
3. Use a content delivery network (CDN). Many CDNs have servers in or near African markets and can cache your website closer to your customers, even if the main site is hosted abroad.
4. Check where your cloud services run. For cloud platforms and SaaS tools, look at which regions are available. Choosing the nearest suitable region can improve speed and may help with data location requirements.
5. Build in redundancy. For critical operations, keep a second internet connection from a different provider, ideally using a different type of link such as fibre plus 4G or 5G, so one outage does not stop the business.
6. Test before you commit. Run speed and latency tests at different times of day on any connection you are considering, and ask current customers about reliability.
7. Keep an eye on the forum’s outcomes. Announcements from ngPIF, IXPN and the NCC can signal new local data centres, peering arrangements or hosting options worth considering.

The bigger picture

As more of Nigeria’s commerce, banking, government services and entertainment move online, the infrastructure behind the screen becomes a competitive issue. Faster, more resilient local connectivity supports everything from mobile payments to cloud accounting. For small businesses, the lesson is simple: ask where your data travels, choose providers and hosts that keep local traffic local where it makes sense, and never depend on a single connection.

Sources

• The Sun: Stakeholders seek cheaper, faster internet through local routing

Featured image: Photo: “Data Centres” by GDS Infographics, CC BY 2.0, via Openverse — source

Read and share the original on Mosravo Endless Solutions Publications