If my website gets hacked……….

(Jan walks gently into the field listening for the CLICK of the landmine…)

I mean who is responsible for my site being vulnerable in the first place.

99.9999% of the time YOU are responsible for your own web site being vulnerable. It’s your site.

Now if you are paying someone or service to maintain your site, and the SLA that you have with them covers patches, backups, maintenance, etc. then you are one of the 0.0001%. As you know, this is the free volunteer support forum and we don’t get many of those problems here.

IANAL but if the web designer’s agreement with you explicitly covers the above items in writing then talk to them. If it does not then you’ll have to clean up yourself or get someone to do it for you.

I’d say 100% of the time you’re responsible for your own site.

Even though you’re paying someone else, you’re responsible for what they do (or don’t). Full responsibility, but not always full control, and if that scared you, good ??

should I have to pay my web designer to put it right?

Depends on what happened and what’s covered by your contract, as Jan said. Could go either way.

my web designer is also hosting my site. So what protection do I have? For example what is to stop a web designer from putting malicious code into any one’s site that they designed just to get them to pay hundreds of pounds to get it cleaned up?

In all honesty? Nothing. But I’ve never come across a host yet who has done that. Sites get hacked every day – often because 1 or more users on a shared server is running insecure or old scripts.

It’s a large reason why many of us here not only have our own WordPress install but also manage our own VPS or dedicated server. We get full control over the whole magilla.

Having that control is comforting and useful but also puts the burden of full responsibility and maintenance on our shoulders.

Bottom line: if you don’t trust your designer and/or host, change ’em.

In fact I do trust my designer, but my site has been hacked and to put it right he wants to charge me. I just wondered if this was what I should expect from him. I don’t know much about web design and hosting and I guess I thought that him hosting it would protect me from malware. If anyone can attack my site at any time this could end up a pretty expensive deal for me, and there is no insurance policy to cover it is there? If my physical office were vandalised I could claim off the insurance. What could I do in the case of my site being vandalised?

my site has been hacked and to put it right he wants to charge me.

As Jan said, in 99.999% of cases, this would be perfectly reasonable. It’s your site – not his. Unless you can prove that it was negligence on the the part of the hosting, then it would be your responsibility to fix it or to pay for someone else to fix it. Even the largest hosting companies do not offer an “insurance policy” against hacking.

Make sure you have backups of your site. To be safe, I like to have my own backup in additional to what my hosting provider gives me.

Most hosting companies store backups for you, in many cases for under $10/mo you’ll get your hosting and say backups for the last 30 days.

@furpist, if you keep a backup of your blog then getting it fixed is not such an issue. I remember asking my host, and it was godaddy then, and it said a database restore would cost me $150. I did not had a backup then, they had it, but they would only provide it to me if i pay them…

lesson learnt, host changed… and from now on, frequent backups are a daily routine.

Now to answer your question, yes you are responsible, because the more you wait to get it fixed, your ranking in search engines suffer further, so no point waiting, get it fixed and quickly. And the only way it will happen is by keeping an off line backup yourself.

In general, most hosts do provide free help, and most designers who host the blogs themselves, do fix errors/bugs and hacking of their own themes for free, just make sure to talk to them about it beforehand.

cheers,