I have a software-development firm based in Austria and my client's website got hacked.

The Client wanted the website to be based on Wordpress, and since Wordpress gets hacked regularly, there was no wonder that the website actually got hacked after some time.

Via the server logs I can clearly see the hack was perpetrated by an exploit of Wordpress itself and not via the server or some other exploit.

I have no backup of the site. The client wants me to rebuild the site without any additional payment.

Am I liable for the damage and do I have to rebuild the site free of cost?

  • Your liability totally depends on your agreement. No one can answer this question without more information. Without further information and based on lots of possibly incorrect assumptions, I might suggest you are liable to rebuld the site because (a) Transfer of the site did not take place and (b) Wordpress is known to be insecure so you should have taken steps to make it more secure. Of-course, if you pointed out Wordpress is insecure to him, and he agreed that the site was complete and made full payment you could argue that your liability is limited to what he paid for hosting ($0).
    – davidgo
    Nov 14 '16 at 23:51

The individuals who hacked the website are responsible. Your concern is not whether you are responsible, but are you liable? It depends on the details of your arrangement with the client. If you have a contract with them that specifies that you will keep their stuff secure against attacks and that you will make regular backups, then you probably are liable. If the contract says that the client is responsible for backups and security, they you probably aren't liable. You also need to look for disclaimer clauses in the contract; and in addition there is this third party, Wordpress. It's not actually clear from your description in what way this is "his website" and not yours (sort of provided as a gift). What exactly is he paying for, and what are you paying for (and who pays who)? What does seem to be the case is that you have a continuing relationship with the client in terms of this site, that is, you didn't just write code and drop it off for him to deal with. That can imply a broader duty to "take care" of the client.

If I get hacked, I would sue the hackers. But if I can't find the hackers, I might sue the host company if they were negligent (in knowingly allowing this potential for exploit to persist) – assuming I have some kind of legal relationship with them (i.e. a contract). But there might be some kind of "we're not liable for anything" clause, or maybe I contracted with you and you contracted with them. In which case I would sue you, in which case it comes down what you promised to do, and whether you were negligent in what you did do. It's not an unreasonable assumption that you should have made a backup copy. A lawyer would need to scrutinize the facts, but applying the sniff test to what you describe, I'd say that you can fix his problem, refund the money, or hire an attorney.

  • Thanks for your reply! To add further information: there is no formal signed contract - it happened via email. It basically runs down to this: He said he wanted a website, I sent him an offer (development only, without hosting, etc.. and without clauses for liablity or anything) and he agreed to that offer via email. ... continuing in the next comment Nov 15 '16 at 7:32
  • And for the confusion about server-exploits or exploits in wordpress itself I would use this metapher for non-technical people: My client wants me to build him a car (with a widely known unsecure lock for example) and then for the comfort parks it on my property without paying or a contract that I'm liable and somebody breaks into his car and trashes it, I don't think I'm responsible, but I might be wrong - hence the post! Nov 15 '16 at 7:38

since Wordpress gets hacked regularly...

This is really your opinion and has nothing to do with the situation other than your discussions with your client. WordPress is free, open source software, and their TOS points out that the software is licensed under the GNU General Public License, there is no liability implied in any regard, and you are on your own: https://wordpress.org/about/gpl/

The installation on the server is completely unusable and destroyed, no backups etc. and the client wants me to rebuild the site exactly like it was, without paying me again....Also it should be noted, that I hosted the website for him

You may have some recourse against the web server company itself, if you are using a third-party webhost. Read the webhost's TOS regarding their backups, security and guarantees. Most absolve themselves of all liability, anyway, and require you to have your own backups.

If you were running your own server from home/office and administering it yourself, you are solely responsible. You are by default responsible for your own work and your own backups.

because he couldn't get around to host it himself....

You should have had him hosting the site to absolve you of hosting responsibility. Was this an oversight of yours or his? Yet another discussion to have with the client.

he clearly insisted from the beginning to use a widely known vulnerable system ...

Again, mostly an opinion, unless you want to get an expert witness to outline the vulnerabilities of WordPress and hosting environments. The relationship between software on a server and the server itself and security is a tricky legal argument.

there was no contract for maintenance afterwards...

Of WordPress itself? There is no contract in the GPU, and WordPress's own security team urges updates ASAP.

Or a "contract for maintenance" of the website and hosting as a whole? What kind of written or verbal agreement did you have with the client?

Am I liable for the damage and do I have to rebuild the site free of cost?

This all comes down to the agreement and/or contract you have with him, either verbal or written.

And this also depends on local and national contract laws where you are located - USA? - and in Austria.

The hackers have little to do with it, other than the back itself; I doubt you can catch them, even if they are liable. The hack may have even been by a "bot", software that scans the web looking for vulnerable sites, and as such will leave few traces.

You can always check the https://archive.org/web/ to see if you can salvage any content from the old site.

But, with no agreements in place - or very vague agreements and assurances - it sounds like you are the one liable, and you may simply have to rebuild the site or pay someone to do it, or refund the money. Getting a lawyer is an option, but it is your decision; there may be more money involved in a legal recourse than simply rebuilding the site or a refund.

Updated 11/15/16 in response to comments:

He said he wanted a website, I sent him an offer (development only, without hosting, etc.. and without clauses for liability or anything) and he agreed to that offer...

That's a (vague) contract for a website without hosting, yes; and you don't have details about who is responsible for backups and liability. It falls on you; you're doing the work for the client, and the client is not working for you.

My client wants me to build him a car (with a widely known insecure lock for example) and then for the comfort parks it on my property without paying or a contract that I'm liable and somebody breaks into his car and trashes it, I don't think I'm responsible

That's an inaccurate metaphor, because you are using WordPress to "build the car", not from scratch from a pile of metal and plastic, and the WordPress GNU license says "open source" and "no liability assumed or implied." So if the door locks are defective, it's your fault for not knowing that and taking that into account.

And you are building it on your property (your own hosting) without an agreement to build it there or secure it there, rather than the client's webhost (where he/they would be responsible, or not responsible according to the webhost TOS and the server stack, probably a mix of open source/commercial software), which is breaking your own work agreement.

And, you still haven't said anything about your server where the hack took place. What was the state of software? Whose server? Yours? Did you own/maintain it? That's all your problem and liability. None of that liability is outlined in the agreement with the client.

What you're trying to do is blame WordPress and your failures at writing work agreements and failures to maintain data backups and your webserver for your legal (and ethical and financial) problems.

You have no argument with WordPress; it was your choice to work with a client who wanted to use it. You have some argument with the client because they didn't get their own hosting; but you didn't abide by your own agreement. Most of your arguments are with your own issues.

This is straying into legal advice territory, but: you can either give a refund, rebuild the site for free, or get a lawyer. Or you can ignore it all and possibly be sued.

  • Thanks again for your reply! At first I want to clarify, I never intended to blame WordPress, the company. Rather that the client himself has choosen this (unsecure) system. About my server: It is a root server on a german hosting provider - running the latest debian distro, all updates installed (well except for the WordPress installation), firewalled and secured after industry-standard. Nov 15 '16 at 19:41
  • It was your choice to work for a client who wanted to use a software package that you consider insecure; you didn't have to work for him. And again, you outlined no details on liability for security - you or him - in your contract. And if your server was administered by someone else, i.e. a server company, and was leased as a managed server, they are responsible to some extent, as per the TOS; read it. If you were the sole root and administrator for the server, and the server was leased as unmanaged, the TOS will probably say that you are solely responsible for security/maintenance. Nov 15 '16 at 22:42

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.