1. About these terms
1.1 These terms cover the Hacked Site Rescue (“the Rescue”) from HOSTNEY, LLC (“we” or “us”). They apply on top of our Terms of Service, Acceptable Use Policy, Privacy Policy and Data Processing Addendum. Where those documents and these terms disagree about the Rescue, these terms apply.
1.2 You accept these terms when you tick the box on the payment page and pay.
2. What the Rescue covers
2.1 The Rescue is for one WordPress site. We:
- copy the site into an environment we control;
- look for malware and unauthorized changes in its files and database, and remove what we find;
- compare WordPress and any plugins and themes that have public official copies with those copies;
- remove accounts you didn’t create, set new administrator passwords and replace WordPress’s secret keys;
- update WordPress, plugins and themes where a current version exists;
- tell you how the attacker got in, if the logs we can see show it;
- move the clean site into a Hostney account in your name and help with the DNS switch; and
- include one year of the Startup plan, as section 9 describes.
2.2 The Rescue doesn’t include:
- moving email or mailboxes;
- recreating files or data that are missing or damaged;
- rebuilding or redesigning a site, or repairing a theme or plugin;
- replacing an abandoned plugin or theme;
- buying licenses for paid plugins or themes;
- dealing with Google, other search engines, browser makers, blocklists or your current host on your behalf;
- forensic reports, or legal, compliance or insurance advice; or
- telling anyone about a data breach. Whether you have to, and who you have to tell, is for you and your lawyer.
2.3 We don’t take these sites:
- WordPress Multisite networks;
- sites not built on WordPress, unless we agree otherwise in writing before you pay;
- sites that store or handle protected health information, cardholder data or other regulated or sensitive information, as section 13 of the Terms of Service and the “Regulated and Sensitive Information” section of the Acceptable Use Policy describe; and
- sites that break the Acceptable Use Policy.
Our services are not HIPAA compliant, and we don’t sign Business Associate Agreements. If we find out that a site is one of these, we may stop at any point, delete our copy and refund you under section 5.
2.4 Any time we give you is an estimate. How long a Rescue takes depends on the size of the site, what we find and how fast your current host lets us copy it.
3. Your authority and your access
3.1 You confirm that you own the site, or that its owner has authorized you to give us access and to have us copy and change it. We may ask you to prove this. If you can’t, we stop, delete our copy and refund you under section 5.
3.2 Send logins only through the secure link we give you. Don’t put them in our form or in email. We use them only for the Rescue. Change those passwords once the Rescue has ended.
3.3 We don’t clean anything at your current host. To copy the site we may need to do something there that the copying requires, such as installing our migration plugin. Keep your hosting and your own backups until the site is live on Hostney.
4. Payment
4.1 The price is $299 in US dollars for one site, plus any taxes that apply. You pay it in full before we start. We start once you’ve paid and given us access.
4.2 If you don’t give us working access within 30 days of paying, we close the Rescue and refund you.
5. If we can't fix it
5.1 If we can’t fix the site, we tell you why, refund the full amount and delete our copy. There are no conditions on this refund.
5.2 We can’t fix a site when, for example:
- we can’t get the access we need;
- the way in was an abandoned plugin or theme and the site can’t run without it on current WordPress and PHP, so a cleanup wouldn’t last;
- we can’t get clean copies of what the site needs;
- the damage is too great to repair; or
- we find no hack.
5.3 We make this decision in good faith. Refunds go to the original payment method, as section 4.9 of the Terms of Service says.
6. Cancelling
6.1 You can cancel for a full refund until you’ve given us access.
6.2 Once you’ve given us access, we’ve started the work and you can’t cancel. From then on, section 5 is the only refund. For the Rescue, this section replaces section 6 of the Terms of Service.
6.3 If you are a consumer in a country that gives you a right to withdraw from a contract made at a distance, then by ticking the box on the payment page you ask us to start before that period ends, and you acknowledge that you lose that right once the Rescue is fully performed. If you withdraw after we’ve started and before we’ve finished, you pay for the share of the work done up to that point. Nothing in these terms takes away a right that the law says can’t be waived.
7. Completion
7.1 The Rescue is complete when we email you that the site is clean and give you a preview address (“Completion”).
7.2 “Clean” means that:
- the malware and unauthorized changes we found have been removed;
- WordPress, and any plugins and themes with public official copies, match those copies or their current versions; and
- our scanners come back clear at Completion.
7.3 The payment is final at Completion.
7.4 We work only with the files and data we receive from you or copy from your current host, plus public official copies of WordPress, plugins and themes. We don’t recreate anything that’s missing or damaged, whatever caused it, including uploads, custom code, content and database records. Missing or damaged files or data don’t stop a site from being clean.
7.5 If something that worked in the copy we received doesn’t work on the clean site, and our cleanup caused it, tell us within 30 days of Completion and we’ll fix it from that same data. This is your remedy for that problem, and it doesn’t reopen the refund.
8. Our environment and your site
8.1 We work in an environment we control. Until Completion you don’t get the files, the database or logins for the copy. After Completion, the preview address shows you the pages of the site.
8.2 We move the site into your Hostney account when you’re ready. If you aren’t ready within 30 days of Completion, we may delete our copy, and the payment stays final.
8.3 Your site and its content stay yours. You allow us to copy and change them for the Rescue, and for nothing else.
8.4 We handle any personal data in the site under our Privacy Policy and Data Processing Addendum. If we find card numbers or other data that the hack collected, we delete it from our copy and tell you.
8.5 We keep our records of the Rescue for 12 months after it ends, so we can answer billing disputes. They include your acceptance of these terms, our findings, excerpts of logs and our messages with you. They don’t include a copy of your site.
9. The year of hosting
9.1 The year of the Startup plan starts on the day the site moves into your account. The Terms of Service and the Acceptable Use Policy apply to it.
9.2 If the site needs more than the Startup plan offers, you pay the difference to the plan it needs for that year. We tell you before you pay for the Rescue if we can see this in advance, and before the site moves if we can’t.
9.3 That year doesn’t renew by itself, and you don’t need a payment method on file during it, whatever sections 4.4 and 5 of the Terms of Service say. To stay after the year, choose a plan at its normal price.
9.4 You can cancel the hosting at any time. That doesn’t refund any part of the Rescue. The year has no cash value and you can’t transfer it.
10. What we can't promise
10.1 No scan can prove that a site is free of every threat, and a clean site can be hacked again.
10.2 We can’t undo what happened before the Rescue, including data the attacker took or deleted.
10.3 Spam pages can stay in search results after they’re gone, and browser warnings lift only after the company behind them reviews the site. You ask for those reviews yourself.
10.4 Section 12 of the Terms of Service applies to the Rescue. Our total liability for the Rescue is limited to the amount you paid for it.
10.5 Section 11 of the Terms of Service also covers claims that you had no right to give us access to a site or to have us change it.
11. Billing disputes
11.1 Section 4.8 of the Terms of Service applies: write to support@hostney.com within 30 days of the charge before you dispute it with your payment provider.
11.2 If you dispute the charge after Completion, we may send your payment provider these terms, your acceptance of them and our record of the work. We may also suspend the account, as section 4.8 says. If the charge is reversed, the year of hosting ends, because it was part of what you paid for.
12. Everything else
12.1 The governing law, venue and arbitration sections of the Terms of Service (14.3 and 14.4) apply.
12.2 The version of these terms in force when you paid applies to your Rescue.
12.3 Questions go to support@hostney.com.
