If my client&#39;s website gets hacked, who is responsible?
<p>I have a software-development firm based in Austria and my client's website got hacked.</p>

<p>The Client wanted the website to be based on Wordpress, and since Wordpress gets hacked regularly, there was no wonder that the website actually got hacked after some time.</p>

<p>Via the server logs I can clearly see the hack was perpetrated by an exploit of Wordpress itself and not via the server or some other exploit. </p>

<p>I have no backup of the site.  The client wants me to rebuild the site without any additional payment.</p>

<p>Am I liable for the damage and do I have to rebuild the site free of cost?</p>

<p>The individuals who hacked the website are responsible. Your concern is not whether you are responsible, but are you liable? It depends on the details of your arrangement with the client. If you have a contract with them that specifies that you will keep their stuff secure against attacks and that you will make regular backups, then you probably are liable. If the contract says that the client is responsible for backups and security, they you probably aren't liable. You also need to look for disclaimer clauses in the contract; and in addition there is this third party, Wordpress. It's not actually clear from your description in what way this is "his website" and not yours (sort of provided as a gift). What exactly is he paying for, and what are you paying for (and who pays who)? What does seem to be the case is that you have a continuing relationship with the client in terms of this site, that is, you didn't just write code and drop it off for him to deal with. That can imply a broader duty to "take care" of the client.</p>

<p>If I get hacked, I would sue the hackers. But if I can't find the hackers, I might sue the host company if they were negligent (in knowingly allowing this potential for exploit to persist) – assuming I have some kind of legal relationship with them (i.e. a contract). But there might be some kind of "we're not liable for anything" clause, or maybe I contracted with you and you contracted with them. In which case I would sue you, in which case it comes down what you promised to do, and whether you were negligent in what you did do. It's not an unreasonable assumption that you should have made a backup copy. A lawyer would need to scrutinize the facts, but applying the sniff test to what you describe, I'd say that you can fix his problem, refund the money, or hire an attorney.</p>

<blockquote>
  <p>since Wordpress gets hacked regularly...</p>
</blockquote>

<p>This is really your opinion and has nothing to do with the situation other than your discussions with your client. WordPress is free, open source software, and their TOS points out that the software is licensed under the GNU General Public License, there is no liability implied in any regard, and you are on your own: <a href="https://wordpress.org/about/gpl/" rel="nofollow noreferrer">https://wordpress.org/about/gpl/</a></p>

<blockquote>
  <p>The installation on the server is completely unusable and destroyed,
  no backups etc. and the client wants me to rebuild the site exactly
  like it was, without paying me again....Also it should be noted, that
  I hosted the website for him</p>
</blockquote>

<p>You may have some recourse against the web server company itself, if you are using a third-party webhost. Read the webhost's TOS regarding their backups, security and guarantees. Most absolve themselves of all liability, anyway, and require you to have your own backups.</p>

<p>If you were running <em>your own server</em> from home/office and administering it yourself, you are solely responsible. You are by default responsible for your own work and your own backups. </p>

<blockquote>
  <p>because he couldn't get around to host it himself....</p>
</blockquote>

<p>You should have had him hosting the site to absolve you of hosting responsibility. Was this an oversight of yours or his? Yet another discussion to have with the client.</p>

<blockquote>
  <p>he clearly insisted from the beginning to use a widely known
  vulnerable system ...</p>
</blockquote>

<p>Again, mostly an opinion, unless you want to get an expert witness to outline the vulnerabilities of WordPress <em>and</em> hosting environments. The relationship between software on a server and the server itself and security is a tricky legal argument.</p>

<blockquote>
  <p>there was no contract for maintenance afterwards...</p>
</blockquote>

<p>Of WordPress itself? There is no contract in the GPU, and WordPress's own security team urges updates ASAP.</p>

<p>Or a "contract for maintenance" of the website and hosting as a whole? What kind of written or verbal agreement did you have with the client?</p>

<blockquote>
  <p>Am I liable for the damage and do I have to rebuild the site free of
  cost?</p>
</blockquote>

<p>This all comes down to the agreement and/or contract you have with him, either verbal or written.</p>

<p>And this also depends on local and national contract laws where you are located - USA? - and in Austria.</p>

<p>The hackers have little to do with it, other than the back itself; I doubt you can catch them, even if they are liable. The hack may have even been by a "bot", software that scans the web looking for vulnerable sites, and as such will leave few traces.</p>

<p>You can always check the <a href="https://archive.org/web/" rel="nofollow noreferrer">https://archive.org/web/</a> to see if you can salvage any content from the old site.</p>

<p>But, with no agreements in place - or very vague agreements and assurances - it sounds like you are the one liable, and you may simply have to rebuild the site or pay someone to do it, or refund the money. Getting a lawyer is an option, but it is your decision; there may be more money involved in a legal recourse than simply rebuilding the site or a refund.</p>

<p><strong>Updated 11/15/16 in response to comments:</strong></p>

<blockquote>
  <p>He said he wanted a website, I sent him an offer (development only,
  without hosting, etc.. and without clauses for liability or anything)
  and he agreed to that offer...</p>
</blockquote>

<p>That's a (vague) contract for a website without hosting, yes; and you don't have details about who is responsible for backups and liability. It falls on you; you're doing the work for the client, and the client is not working for you.</p>

<blockquote>
  <p>My client wants me to build him a car (with a widely known insecure
  lock for example) and then for the comfort parks it on my property
  without paying or a contract that I'm liable and somebody breaks into
  his car and trashes it, I don't think I'm responsible</p>
</blockquote>

<p>That's an inaccurate metaphor, because you are using WordPress to "build the car", not from scratch from a pile of metal and plastic, and the WordPress GNU license says "open source" and "no liability assumed or implied." So if the door locks are defective, it's your fault for not knowing that and taking that into account.</p>

<p>And you are building it on your property (your own hosting) without an agreement to build it there or secure it there, rather than the client's webhost (where he/they would be responsible, or not responsible according to the webhost TOS and the server stack, probably a mix of open source/commercial software), which is breaking your own work agreement.</p>

<p>And, you still haven't said anything about <strong>your</strong> server where the hack took place. What was the state of software? Whose server? Yours? Did you own/maintain it? That's all your problem and liability. None of that liability is outlined in the agreement with the client.</p>

<p>What you're trying to do is blame WordPress and your failures at writing work agreements and failures to maintain data backups and your webserver for your legal (and ethical and financial) problems.</p>

<p>You have <em>no argument with WordPress</em>; it was your choice to work with a client who wanted to use it. You have <em>some argument with the client</em> because they didn't get their own hosting; but you didn't abide by your own agreement. Most of your arguments are with your own issues.</p>

<p>This is straying into legal advice territory, but: you can either give a refund, rebuild the site for free, or get a lawyer. Or you can ignore it all and possibly be sued.</p>

business liability