Setting Up a Simple and Secure Online Shopfront

Choose one useful sales channel and protect the accounts that customers rely on.

Part 4 of 10 | Starting an Online Business in The Gambia

Learning goals

Choose an initial shopfront, prepare the information customers need and secure the accounts used to operate it. Understand the difference between a catalogue, a conversation and a working checkout. The practical outcome is a draft setup plan, not a requirement to publish a website or open financial accounts. Use the current official instructions for the exact app and account you choose.

Before you begin

Start with the offer and customer behaviour already investigated. A messaging-based shop, a marketplace listing and an independent website solve different problems. Do not pay for a complex store simply because it looks professional in a demonstration. You need a clear way to display the offer, receive enquiries, confirm orders and provide support. Automating those steps can come later when volume justifies it.

Step 1 Choose the smallest workable channel

A business messaging profile can support conversations and product information, while a marketplace may help people discover listings. An independent website gives more control over presentation but requires maintenance and a usable ordering process. Compare the audience, costs, restrictions and work required. Do not assume every catalogue, checkout or payment feature is available to every Gambian account.

WhatsApp's official business policy covers messaging conduct and commerce eligibility. Check the exact product category and feature before relying on it. A business may be able to discuss customer service while a particular commerce feature or product remains restricted. Do not treat the Business app and the Business Platform as identical or copy Platform automation rules into an ordinary app workflow without checking applicability.

Step 2 Prepare clear public information

Use a consistent business name, concise description, contact route, response hours and fulfilment area. State whether orders are confirmed by message or through a tested checkout. Include the information needed to resolve an order problem. Avoid publishing a private household address when a safer agreed collection arrangement is sufficient; customers still need accurate fulfilment information at the appropriate stage.

Test the shopfront on a normal phone screen. Can someone find the product, price, delivery conditions and next action without watching a large video? Use readable text and reasonably sized images. If a link fails or a button leads nowhere, fix it before promotion. A decorative page does not become a functioning business channel until the customer can complete the intended journey.

Step 3 Protect account access

Use strong unique passwords and enable the strongest suitable multifactor authentication offered by each account. CISA's small-business guidance recommends MFA as an additional layer of protection. Keep recovery methods current and store recovery codes securely away from public files and product photos. Never share login codes or approve an unexpected sign-in request because someone claims to be platform support.

Secure the phone with a screen lock, keep software updated and use official app sources. Give staff only the access they need through supported roles where available. Avoid a shared password passed around in group messages. Decide who owns recovery access before a helper sets up the account, so the business does not lose control when that person leaves.

Step 4 Prepare for a lost phone or interrupted connection

Keep a secure backup of essential order information and original product assets in a suitable separate location. Do not store customer information in a publicly shared folder. Know how to use official recovery routes from another trusted device. An independent support contact can help customers reach you if one channel fails, provided it is kept accurate and secure.

Plan response hours realistically and communicate delays honestly. A power or connection interruption should not cause staff to guess whether an order was paid or already dispatched. Reconcile the actual account and order status when service returns. Never ask a customer to pay again simply because you cannot currently access the first payment record.

Guided exercise

1. Compare two channels for your offer and choose one initial channel with a reason tied to customer behaviour and workload.

2. Draft the public profile information and map the steps from viewing an item to order confirmation. Keep it unpublished during practice.

3. Make a private security checklist covering ownership, unique passwords, MFA, recovery and staff access. Do not write real secrets into the course exercise.

4. Test a mock listing on a phone-sized screen and identify missing information or unusable links.

5. Rehearse a lost-phone scenario on paper. Explain how orders are protected, access is recovered and customers receive an accurate update.

Knowledge check

1. Does a catalogue automatically provide a working payment checkout?

2. Should a helper become the only person with account recovery access?

3. Can every platform feature be assumed available in The Gambia?

Answer guide

1. No. Check and test the actual order and payment route.

2. No. The business needs controlled and recoverable ownership.

3. No. Verify the exact country, account, product and feature conditions.

Completion standard

Produce a channel decision, public-profile draft, customer journey and security plan. Explain how the business would continue handling existing orders during a disruption. Account access and customer data must remain protected; no live publishing or credential sharing is required.

Sources and verification notes

WhatsApp Business policy. Checked 18 September 2026. Official policy URL redirects to whatsappbusiness.com/policy. Consult the current policy for messaging and commerce eligibility; app and Platform features are not interchangeable.

CISA small business multifactor authentication guidance. Checked 18 September 2026. Official indexed technical guidance checked; direct retrieval failed. Used for general account security principles, not current Gambian policy or a guarantee against fraud.