When a client website gets hacked, how much of it lands on your agency depends on two things: what your contract says you maintain, and whether you did that work. The client will call you either way. Spend the first hour containing the damage, preserving evidence, and telling the client before Google's red warning screen does it for you.
Who is responsible when a client website gets hacked?
Under a typical agency contract, responsibility for a hack follows your maintenance scope. If you promised updates, backups or security and can't show you delivered them, the cleanup is yours to absorb. If the client is build-only with no retainer, security is theirs on paper, though they will still phone you first.
That last part is what costs agencies money. A client who paid you $8,000 for a site two years ago does not remember the handover email that said maintenance was their job. They remember your name in the footer. When customers start forwarding screenshots of a casino redirect, you're the number they have saved.
Three questions decide where the bill lands:
- What does the contract say you maintain? "We apply core, plugin and theme updates weekly" is a duty you can prove you met. "We keep your site secure" reads to a client like a guarantee, and a hack is proof you broke it.
- What do your logs show? If the entry point was a plugin that got a patch six weeks ago, and your update log shows that plugin skipped for six weeks, the conversation is over before it starts.
- Who controls the hosting? If you resell hosting, the server's security is your vendor's job toward you and your job toward the client. If you host through a provider that works behind your brand, such as our white-label hosting for agencies, read what that provider covers for malware before you need it.
Plugin logs carry most of the weight because plugins are where most breaches start. According to Patchstack's State of WordPress Security report, 7,966 new vulnerabilities were disclosed in the WordPress ecosystem in 2024, and 96% of them were in plugins (2025). WordPress core accounted for a handful.
| Your arrangement with the client | Who the client blames | Who carries it on paper | What you can usually bill |
|---|---|---|---|
| Build only, handed over, no retainer | You | The client | Full cleanup at your emergency rate |
| You resell hosting, no maintenance scope | You | Split between you and your hosting vendor | Cleanup time, minus whatever your vendor covers |
| Care plan with updates, updates done and logged | You | Mostly the client, if logs show the patch was applied | Cleanup per plan terms or hourly |
| Care plan with updates, updates skipped | You | You | Very little; plan to absorb it |
| Care plan that promises "security" or "malware protection" | You | You | Usually nothing; the client paid for this |
Most agency templates also carry a limitation of liability clause, often capped at the fees paid over the previous 12 months. That clause protects you from a lawsuit over lost sales. It does nothing for the relationship. Treat this section as a business read, and have a lawyer look at your own agreement before you lean on it.
What should an agency do in the first hour after a hack?
Work in a fixed order: confirm it's a hack, contain it without deleting anything, take a full snapshot as evidence, then call the client. Cleanup comes after all four. Agencies that start deleting suspicious files in minute five destroy the timeline they'll need when the client asks how this happened and whose fault it was.
- Confirm it's a hack. A site that won't load is often DNS, an expired certificate or a suspended hosting account. Run the 20-minute triage for a site that suddenly won't load before anyone says the word "hacked" to a client. If the alarm came from the host, verify the infection notice yourself in about 15 minutes.
- Contain without destroying. Put the site in maintenance mode or block public traffic at the server or CDN. Rotate every credential: WordPress admins, hosting panel, SFTP, the database password, and any API keys stored in wp-config.php. Log out all active sessions. Delete nothing yet.
- Preserve evidence. Take a full copy of files and database before you change anything else. Download the raw access and error logs, because some shared hosts keep only a few days of them. Screenshot the defacement or redirect with a timestamp and export the list of admin users. This is how you answer "how did they get in" with facts, and it's what an insurer or lawyer will ask for if customer data was exposed.
- Call the client before Google does. If Google Safe Browsing flags the site, Chrome shows visitors a full-page red warning and the client may get a Search Console email. Hearing it from you first, with a plan already moving, is what keeps the account.
The warning tends to outlast the cleanup. According to Google's Search Console Help documentation, review requests for sites hacked with spam can take several weeks, while malware reviews usually take a few days (2025). Give the client that timeline on the first call so day three doesn't feel like a second failure.
The file-by-file removal process lives in our step-by-step WordPress malware removal guide, so it isn't repeated here. If the attack injected spam pages or redirects, the SEO spam and redirect recovery steps cover getting them out of Google's index.
How do you tell a client their website was hacked?
Make it a phone call. Lead with the fact, then what you've already done, what you don't know yet, what you need from them, and when they'll hear from you next. Keep cause and cost until after the containment facts, and never guess at either one. The script below takes about five minutes to get through.
Adapt the brackets and keep the order:
- Open with the fact. "I'm calling because we found malware on your website this morning. We've already contained it, and I want to walk you through what we know and what happens next."
- Say what you know and what you don't. "The site was sending mobile visitors to a spam page, and there's an admin account we didn't create, added on [date]. We don't know yet how they got in. I'll have that for you by [time]."
- Say what you've done. "The site is in maintenance mode, every password has been changed, and we took a full copy of the site as evidence before touching anything."
- Ask for what you need. "Two things from you. Please don't log in until I tell you it's clean, and let me know if anyone on your team got an odd email or password reset in the last two weeks."
- Set the timeline. "We expect the site back by [time]. If Google has flagged it, that warning can take longer to clear, and I'll update you on it separately."
- Cover cost only if it's outside scope. "This falls outside your current plan, so it's billed at our emergency rate. I estimate [range] and I'll send that in writing within the hour." If it's inside scope, say so: "This is covered under your plan."
- Book the next call. "I'll call you again at [time] whether or not there's news."
Leave some things out of that call. Don't guess at the cause, don't name a plugin developer as the culprit before you've checked, and don't tell the client it's no big deal. Don't promise a recovery time you can't hit. Every guess you make on the first call is a statement you'll have to walk back on the second.
If the site takes orders, runs a membership area or stores form submissions, the hack may count as a personal data breach. Under GDPR Article 33, the data controller (your client) must notify its supervisory authority within 72 hours of becoming aware of a breach, and a processor (often you) must tell the controller without undue delay. US state breach laws vary. You aren't the client's lawyer, so your job on the call is to raise it and tell them to contact their lawyer and insurer the same day.
What can an agency bill for after a client site is hacked?
You can bill for cleanup when the hack falls outside your written scope: build-only clients, hosting-only clients, or a breach through something you never agreed to manage. You can't credibly bill when the entry point sits inside your scope and your logs show a gap. Work done after cleanup, such as hardening, is billable either way.
Here's the math on one incident. Say the cleanup takes eight hours across investigation, removal, verification and the Google review request, and your emergency rate is $175 an hour. That's a $1,400 invoice if the hack falls outside your scope, or $1,400 of senior time you eat if it falls inside.
When it's billable, these line items hold up:
- Log review and finding the entry point
- Malware removal and file verification
- Credential rotation and hardening
- The Google review request and follow-up
- Client calls and the written incident report
Send the estimate as a change order within an hour of the call, with a range. "Six to ten hours at $175" gives the client something to approve. An open-ended "we'll bill as we go" during an incident turns into an invoice dispute three weeks later.
The week after a hack is also the week a client is most open to a maintenance retainer, because they just watched their site redirect to a pill shop. Offer it once, in writing, with a price. Our care plan pricing guide has real numbers to start from. Don't pitch it on the first call.
The bill you should never send is the second cleanup invoice. If the site gets reinfected two weeks after you cleaned it, the client will assume you missed something, and usually they're right. Backdoors that survive a cleanup are the most common reason, and TopSyde Sentinel found 63 of them across 340+ client sites. Build a re-scan at day 7 and day 30 into every cleanup quote.
What does a client hack cost an agency that cleans it up itself?
Even a billable hack costs more than the invoice shows. Cleanup hours land on top of scheduled work, a senior person gets pulled off paying projects, and the client's confidence in you drops in a way no invoice repairs. An unbilled hack is worse: the hours are a straight loss, and you lose a likely referral too.
Take an agency with 40 client sites and two hacks a year. Each one eats eight hours of cleanup and verification, plus three hours of calls, Google follow-up and the incident write-up. At a $125 blended hourly cost, that's 22 hours and $2,750 a year if neither hack is billable. Then add the launch that slipped that week for a different client, and the hacked client who starts taking quotes from other agencies three months later.
The site owner's side of the ledger is in our breakdown of what a WordPress security breach costs. For an agency, the expensive part is the trust, because one bad week with a client can undo years of good work.
How can an agency stop being the cleanup crew for client hacks?
Move malware detection and removal down to the hosting layer, so a hack becomes a ticket your host closes and you report on. TopSyde hosting includes TopSyde Sentinel, which scans every client site daily from the server side, and malware removal is part of the plan, from $89/mo per site, under your agency's brand.
Server-side scanning matters because a security plugin runs inside the same WordPress install as the malware it's hunting, and modern malware is written to hide from it. TopSyde Sentinel reads the files and database from outside WordPress and cleans reversibly, so a bad removal can be rolled back. The write-up on AI-generated WordPress malware explains why signature-only scanners keep missing it.
Because the hosting is white-label, your clients see your name on everything. When an incident happens, you make the client call from the script above and send the report, and we do the removal. You stay the advisor who calls with a plan, not the person restoring files at 11pm.
On response times, a site-down ticket is answered within 15 minutes, 24/7, and other tickets get a reply in under 2 hours during business hours, as set out in our service level agreement. Per-site rates drop as you add sites; the details are on the pricing page.
Every plan comes with a 30-day money-back guarantee. If you're running client sites on a mix of hosts and the last hack ate a week of your calendar, talk to us about agency hosting and we'll plan the move with you, starting with the sites that worry you most.
Frequently Asked Questions
Is a web agency legally liable if a client's website gets hacked?
It depends on the contract. Liability usually tracks what you agreed to maintain and whether you can show you did it, and many agency agreements cap damages with a limitation of liability clause. Have a lawyer review your specific terms, because wording and local law both matter.
Should I tell the client before I know how the site was hacked?
Yes. Call as soon as the site is contained and you've taken a snapshot, say the cause is still under investigation, and give a time for your next update. Waiting until you have every answer risks the client hearing about it from a customer or a Google warning first.
Can I charge a client for malware removal if I host their site?
If your hosting agreement covers hosting only and says nothing about malware, cleanup is usually billable at your emergency rate. If you sold the plan with words like "secure" or "malware protection", the client will reasonably expect it covered. Check what your own hosting provider includes, since removal may already be part of what you pay for.
How do I write a care plan so a hack isn't automatically my fault?
Describe tasks you can prove, such as weekly plugin updates, daily backups kept for 30 days and daily malware scans, and avoid promising an outcome like "your site will stay secure". Log every update and scan with a date. A lawyer can add the limitation of liability and exclusions that fit your jurisdiction.
DevOps & Security Lead
12+ years DevOps, Linux & cloud infrastructure certified
Marcus leads infrastructure and security at TopSyde, managing the server fleet and AI monitoring systems that keep client sites fast and protected. Former sysadmin turned WordPress hosting specialist.
