# My website was hacked: is the web host, the agency or me responsible?

> Who is responsible when your website or store is hacked: you, your web host or your agency. What the GDPR says, what to check in contracts and what to ask.

URL: https://webintacta.com/en/guides/who-is-liable-hacked-website
Language: English (Spanish version: see the hreflang alternate of the HTML page)
Last updated: 2026-10-24

**In short:** If your website or store is hacked, you are the one responsible toward your customers and the data protection authority, as the business owner and the party in charge of the data; the web host answers for its server and the agency for what you agreed in writing. Whether the host or the agency has to pay for anything depends on the contract and on whether they failed their own obligations, not on the hack itself. If personal data is affected, notifying the authority (within 72 hours under the GDPR) is your job.


By Jose Soriano (WebIntacta) · published 2026-10-24

It is one of the first questions I get when a hacked store comes in: “Shouldn't my host have prevented this?” or “Isn't this the agency's job, since they built the site?” The short answer is that, toward your customers and under data protection law, you are the one responsible, and what you can claim from the others depends on what you agreed with them. I explain it from the technical side, which is mine; for the legal side of your specific case, talk to a lawyer.

## The short answer

| Who | What they are usually responsible for | What it usually doesn't cover |
| --- | --- | --- |
| You (owner of the website or store) | Your customers' data, toward them and the data protection authority; deciding who has access; hiring (or not) maintenance | You can delegate the work, not the responsibility |
| The web host | The server: operating system, isolation between customers, network, the PHP versions it offers and its backups, if included | The WordPress, PrestaShop or application you install, its plugins or modules and your passwords, unless your plan says otherwise |
| The agency or developer | Whatever the contract says: building the website, and maintaining and updating it only if you hired that | Flaws discovered after the website was delivered, if there is no maintenance contract |
| The attacker | The crime | In practice, they are almost never identified |

The usual split. What counts in your case is what each contract says.

Why it is you: the GDPR, the EU-wide data protection regulation, calls the party that decides why and how personal data is used the **controller**, and on a store or a website with forms that is you. The host and the agency, when they process that data on your behalf, are **processors**: they have obligations of their own, but they don't replace yours. Outside the EU the names and rules change from country to country, but the idea that the business owner answers for its customers' data is common.

## What the GDPR says

The GDPR applies across the EU, and it can also apply to businesses outside the EU that sell to people in it. The articles that matter here:

- **Article 32 (security):** controller and processor must apply security measures appropriate to the risk. For a website, that includes things as basic as keeping the software up to date and having backups that can be restored.
- **Article 28 (processors):** anyone who processes data on your behalf (host, agency, maintenance provider) must do so under a contract or agreement that sets out what they do with it and what security measures they apply.
- **Article 33 (notification):** if there is a personal data breach, **you** notify your supervisory authority without undue delay and, where feasible, within 72 hours of becoming aware of it, unless it is unlikely to result in a risk. A processor that discovers it must inform you without undue delay.
- **Article 82 (liability):** the processor is only liable for damage when it has not complied with the obligations the regulation places on processors or has acted outside your instructions.

How to notify, step by step, in [data breach in your online store](https://webintacta.com/en/guides/online-store-data-breach-gdpr). In Spain, the supervisory authority is the AEPD (Spain's data protection authority), which has a tool to assess whether you need to notify; elsewhere in the EU, it is your country's supervisory authority.

## The host: does my shared hosting protect me?

Shared hosting protects the server, not your application. It maintains the operating system and the web server, separates your account from other customers' and usually offers backups and some kind of malware scanner. What happens inside your folder (an outdated WordPress plugin, a PrestaShop module with a published flaw, a reused admin password) is your responsibility unless your plan explicitly says otherwise.

- **Read your plan's terms.** Look for words like “automatic updates”, “malware removal”, “managed WordPress” or “backups”: if they are there, the host takes on that part; if not, it doesn't.
- **The host's scanner warns, it doesn't clean.** Many hosts detect malware and suspend your account or send you a notice to protect their other customers. It is a good alarm signal, not a cleanup.
- **When it can be the host:** if the intrusion came through the server (another account on the same server, the hosting control panel, an unpatched PHP or web server version you cannot change yourself). It is uncommon, and it is proven with their logs, not with assumptions.
- **Ask for the logs** (access and error logs) for the days of the attack: many hosts keep them for only a few days. And for the backups from before the intrusion, if they have them.

## The agency or developer

An agency having built your website doesn't make it responsible for every later hack. Flaws in WordPress, PrestaShop and their extensions are discovered and published every week; if nobody updates the website after delivery, the risk grows over time even if it was delivered in good shape.

- **If you have a maintenance contract** with the agency and it includes updates or security, ask what was updated and when. If the way in was a plugin or module with a patch published months earlier that was never applied, that is a conversation to have (and, if it isn't resolved, with a lawyer and the contract in front of you).
- **If there is no maintenance contract**, the agency is generally not responsible for flaws published after delivery. There can be responsibility if it left something done wrong from the start: a pirated (nulled) module, an admin user with a default password, a public backup or debug mode switched on.
- **Always ask for the access details and the list of what is installed**: users, plugins or modules, where they came from and their licenses. If you change providers, get them handed over in writing.

> Before claiming anything from anyone, you need to know how they got in. A cleanup without that information doesn't let you say whether it was the plugin nobody updated, an employee's leaked password or the server. That is why my cleanup report includes the way in and the dates: it is the piece you need to talk to the host, the agency or your lawyer.

## What is up to you, in order

1. **Contain it**: if payments or data are at risk, disable the affected payment method or put the store in maintenance mode. The first hour is covered in [recover a hacked website](https://webintacta.com/en/guides/recover-hacked-website).
2. **Keep evidence**: a copy of the files, the database and the logs as they are, before cleaning. Without them you won't be able to prove anything to anyone.
3. **Assess whether personal data is affected** and, if it is, notify the supervisory authority within 72 hours (and the customers if the risk is high), as the GDPR requires.
4. **Clean up and close the way in**, with a report of what was there and how they got in.
5. **Review the contracts** with the host and the agency with that report in hand, and decide who takes care of maintenance from now on.

If you need free guidance in Spain, INCIBE's **017** (INCIBE is Spain's national cybersecurity institute) is the cybersecurity helpline for citizens, businesses and professionals: free and confidential, every day from 8:00 to 23:00 Spanish time, with the contact channels listed on its website. They tell you what to do; they don't clean the website. Many other countries have a national cybersecurity agency that publishes similar guidance.

> Outside the EU, data protection law and notification deadlines vary a lot from country to country. The technical split between owner, host and agency is the same; for the legal side, ask a local professional.

## If you want me to look at it

Cleaning a hacked WordPress site costs €219 and a PrestaShop or WooCommerce store €349, excluding VAT, with a 90-day guarantee. Both include a report of what was there, how they got in and since when, and for stores, technical guidance for the breach notification to the data protection authority. So it doesn't happen again, [website maintenance](https://webintacta.com/en/website-maintenance) costs €35/month for a website and €69/month for a store, with no lock-in. More details in [hacked website repair](https://webintacta.com/en/hacked-website-repair).

## Sources

- [General Data Protection Regulation (GDPR), official text on EUR-Lex](https://eur-lex.europa.eu/eli/reg/2016/679/oj): articles 4 (controller and processor), 28, 32, 33 and 82.
- [EDPB: Guidelines 01/2021 on examples regarding personal data breach notification](https://www.edpb.europa.eu/our-work-tools/our-documents/guidelines/guidelines-012021-examples-regarding-personal-data-breach_en)
- [AEPD (Spain): guide to managing and notifying personal data breaches](https://www.aepd.es/guias/guia-brechas-seguridad.pdf) (in Spanish)
- [AEPD (Spain): Asesora Brecha tool](https://www.aepd.es/guias-y-herramientas/herramientas/asesora-brecha) (assess whether you need to notify; in Spanish)
- [AEPD (Spain): breach notification on its e-office](https://sedeaepd.gob.es/sede-electronica-web/vistas/infoSede/nbs/guiadoBrechasInicio.jsf) (in Spanish)
- [INCIBE (Spain): 017 cybersecurity helpline](https://www.incibe.es/linea-de-ayuda-en-ciberseguridad) (free; hours and channels; in Spanish)

## Frequently asked questions

### Is my web host responsible if my website is hacked?

Usually not: the host answers for its server, not for the WordPress, PrestaShop or application you install, or for its plugins or modules. Only if your plan includes updates or cleanup, or if the intrusion came through the server itself, may there be something to claim, and that is proven with the logs.

### Is the agency that built my website to blame?

It depends on the contract. Without a maintenance contract, it is generally not responsible for flaws published after delivering the website. With maintenance that included updates, or if it delivered the website with something done wrong (pirated modules, default passwords, public backups), there can be responsibility.

### Who has to notify the data protection authority if data is stolen from my store?

You, as the controller: under the GDPR, within 72 hours of becoming aware of it, unless a risk to people is unlikely. In Spain, that authority is the AEPD. If the host or the agency discovers it, they must inform you without undue delay.

### Does my shared hosting protect me from hacks?

It protects the server and usually warns you if it detects malware, but it doesn't update your website or clean what is inside your account unless your plan says so. Most intrusions come in through a plugin, a module or a password, which are your responsibility or that of whoever maintains the website.

### Can I ask my host for the logs of the attack?

Yes, and the sooner the better: many hosts keep access logs for only a few days. Ask for the backups from before the intrusion too.

## About the author

[Jose Soriano](https://webintacta.com/en/about): Full-stack developer specialized in PrestaShop, WordPress and WooCommerce, who has passed the official PrestaShop course and exam. He has been building online stores and modules since 2023 and is the founder of WebIntacta, the website security service through which he scans, cleans and maintains small-business websites and online stores himself, remotely from Ibi (Alicante, Spain). WebIntacta facts: https://webintacta.com/en/about#datos