Web developer insurance: what UK studios and freelancers actually need

Reviewed by Matthew Bartlett, Director, Apex Insurance Brokers Limited · Last reviewed 2026-08-06

Whether you build brochure sites in WordPress, ship custom React applications, or run a small agency juggling a dozen client retainers, your work carries a specific kind of risk. You are trusted to deliver something that works, on deadline, that handles other people's data and money without falling over. When something goes wrong — a broken checkout, a missed accessibility requirement, a security hole an attacker walks through — the financial consequences usually land on your client first, and then on you. This guide walks through the covers that matter for a web developer or design studio, why each one exists, and what your own clients are likely to insist on before they sign.

What insurance does a web developer really need?

There is no single "web developer policy" you tick a box for. Instead, a handful of covers work together, and the right mix depends on what you build and who you build it for. The building blocks are technology professional indemnity, cyber, public liability, and — the moment you take on staff — employers' liability. If your work involves writing content, sourcing images, or building brands, media and intellectual property liability becomes relevant too.

The useful mental model is this: professional indemnity responds when your work causes a client a financial loss, cyber responds when data or systems are compromised, and the liability covers respond when someone is injured or their property is damaged. Real claims often straddle two of these, which is exactly why they are frequently packaged together in a combined technology policy. If you would like a plain-English overview across the whole category, our guide to what insurance an IT company needs sets the scene.

Why is technology professional indemnity the core cover?

Technology professional indemnity — often written as tech PI, and known in the United States as technology errors & omissions (tech E&O) — is the same idea under different names: cover for the financial consequences when your professional work, advice, or software contains a mistake that causes a client a loss. For a web developer this is the cover that does the heavy lifting, because the thing you are most likely to be blamed for is your own work.

Consider the everyday scenarios. You launch an e-commerce site and a bug in the payment flow double-charges customers for a fortnight before anyone notices. You rebuild a client's site and a botched redirect map wipes out their search rankings and, with them, their sales. You deliver a booking system that miscalculates availability and the client has to honour dozens of overlapping reservations. In each case there is no injury and often no data breach — just a client staring at a real financial hole and a contract that says you were responsible. Tech PI is designed to cover your legal defence and any damages or settlement that follows, including allegations that turn out to be unfounded, which still cost money to see off.

One point worth being precise about: professional indemnity is not a statutory legal requirement for IT firms. There is no law compelling a web developer to hold it. In practice, though, it is almost always a contractual requirement — clients, agencies you subcontract to, and public-sector or enterprise buyers routinely make a stated level of PI cover a condition of the engagement. That is the real reason most developers carry it: not because a regulator demands it, but because you cannot win the work without it. Our deeper explainer on technology professional indemnity insurance goes into how limits and definitions are set.

Larger or more complex risk? Speak directly to a director — call 0117 325 0027 or email info@apexinsurancebrokers.co.uk.

Do web developers need cyber insurance?

Almost always, yes — because of the data and systems you touch that belong to other people. A web developer typically holds client hosting credentials, database access, admin logins, API keys, and often the personal data of the client's own customers flowing through the sites you build. That makes you both a target and a potential route into your clients. If your systems are breached, or a site you host and maintain is compromised, the fallout is rarely just technical.

Cyber insurance is best understood as funding the response to an incident and the third-party liability that can follow, rather than as a magic policy that makes fines disappear. Typically it can support the cost of forensic investigation, notifying affected individuals, legal advice, restoring data and systems, business interruption while you are down, and defending claims brought by clients or third parties whose data was exposed. Where a ransomware attack locks up your own working environment and stops you delivering, that business-interruption element can be the difference between a bad week and a closed business.

Two things to be honest about. First, under UK GDPR and the Data Protection Act 2018, the regulator — the Information Commissioner's Office (ICO) — can impose monetary penalties, but whether such fines are insurable is legally uncertain in the UK and is frequently excluded or restricted. Do not buy cyber cover expecting it to pay a regulatory fine as a matter of course; treat any fines as potentially uninsurable and focus on the breach-response and liability value instead. Second, cyber and tech PI overlap at the edges, which is why they are so often bought together. If you are weighing the two, our comparison of professional indemnity versus cyber insurance for tech companies lays out where each one starts and stops, and cyber insurance explained covers the mechanics.

Why would a web studio bundle tech PI and cyber together?

Because real incidents refuse to stay in one box. Picture a security flaw in a login form you built. The client's customer database is exposed — that is a cyber and data event, triggering breach response and notification. The client then argues the flaw existed because your code was negligent, and sues you for their losses — that is a professional indemnity claim about the quality of your work. One incident, two covers, and endless scope for the insurers to argue about which policy responds if you bought them separately from different providers.

A combined technology policy is built to close that gap. It brings tech PI and cyber under one roof, usually alongside public liability and often the option to add employers' liability, so the covers are designed to dovetail rather than point at each other. For most small to mid-sized web studios this is both simpler to manage and more likely to respond cleanly when a claim spans the professional and the digital at once. It also tends to make renewals and proof-of-cover requests from clients far less of a chore, because it is one certificate rather than three.

What about public liability — I mostly work from a laptop?

Public liability covers injury to other people or damage to their property arising from your business activities. It is easy to dismiss if you picture yourself alone at a desk, but the exposure appears the moment your work leaves your own four walls. You visit a client's office for a discovery workshop and knock a coffee over their server. You attend a trade stand or a pitch and a member of the public trips over your equipment. A courier or client calls at your home office and is injured on the way in. None of these involve a line of code, yet any of them can generate a liability claim.

Public liability is not a legal requirement either, but it is commonly requested in client contracts and by venues, co-working spaces, and event organisers before they will let you in the door. For a developer who works largely remotely, it is usually an inexpensive and sensible addition rather than the centrepiece of your programme — but "I never leave my desk" tends to hold true right up until the meeting where it doesn't.

Do I need employers' liability if I take on staff?

Here the answer is a firm yes, and it is the law. Under the Employers' Liability (Compulsory Insurance) Act 1969, once you employ staff you are generally required to hold employers' liability (EL) insurance, with only narrow exceptions. It covers claims from employees who are injured or become ill because of the work they do for you. This applies as your studio grows — your first hire, an apprentice, and in many cases certain casual or temporary workers can bring you within scope.

The status of the people you work with is what matters, and it is not always obvious. A genuinely independent freelance developer you subcontract to may sit outside EL; someone who works under your direction, on your kit, to your hours may not, regardless of the label on the invoice. Because the compulsory-insurance rules and employment status can be genuinely fiddly, this is a good moment to talk to a specialist rather than guess. If your set-up is closer to a one-person operation using associates, our guidance for the IT contractor route may fit you better than a full employer programme.

What about the content and images on the sites I build?

If your studio writes copy, sources photography, commissions illustration, produces video, or crafts brand names and straplines, you are creating and publishing material — and that opens up media and intellectual property risks. A stock image used beyond its licence, a strapline that echoes a competitor's registered mark, a photograph re-used from another site, or copy that a third party claims defames them can all lead to a claim, even when the mistake was innocent or the asset was supplied by the client.

Media and IP liability cover is designed to respond to allegations such as infringement of copyright, trade marks, or design rights, and to defamation arising from published material. Not every developer needs it — if you build the container and the client pours in their own content, your exposure is lower — but full-service studios that own the creative should treat it as a live consideration rather than an afterthought. It is often available as an add-on within a combined technology or media policy, which keeps things tidy.

Does insurance have anything to do with IR35?

No — and this is worth stating clearly because it comes up constantly among developers who contract. IR35, the off-payroll working rules, is a tax matter about your employment status for tax purposes. Holding insurance — any insurance — does not change your IR35 status, does not determine it, and is not evidence that decides it. Buying tech PI will not move you "outside IR35," and no policy should ever be sold to you on that basis. For your actual IR35 position, speak to a qualified accountant or tax adviser who can assess how you work and contract. Insurance and tax status are simply two different questions, and it pays not to muddle them.

How is the cost of web developer insurance worked out?

We won't quote a figure here, because a meaningful price depends on your specifics — but it helps to know what drives it. Insurers typically weigh your annual turnover and revenue mix, the type of work you do (a marketing microsite carries different risk from a payments platform or healthcare portal), the sectors and size of clients you serve, the indemnity limits your contracts require, the volume and sensitivity of data you handle, whether you employ staff, your claims history, and the security and quality practices you have in place. Higher indemnity limits, riskier sectors, and larger clients push the figure up; tight processes and a clean record help the other way.

Rather than chase a headline premium, the more useful exercise is matching your cover to the contracts you actually sign and the work you actually do — enough limit to satisfy your clients and protect the business, without paying for cover you'll never call on. That is a conversation, not a checkout, and it is exactly the kind of thing our technology team does day in, day out. You can also read our overview of IT and technology business insurance for the wider picture.

If you'd rather talk it through than fill in a form, speak to an Apex technology specialist — we work with web developers, agencies, and IT firms across the UK, and we'll translate the jargon in your client contracts into cover that actually does the job.

Apex Insurance Brokers Limited is authorised and regulated by the Financial Conduct Authority (FRN 724952). This article is general information, not advice on a specific policy or a recommendation to buy any product.