FCA authorised · FRN 724952 0117 325 0027Quote & buy →
IT and telecoms
Yes. If you host websites and email for small businesses, you need professional indemnity insurance. Your customers rarely have an IT department: they rely on you to keep the site up, the mailboxes working, the domain renewed and the padlock showing. When one of those fails, a small business can lose orders, enquiries and reputation within hours, and the claim lands with its host. PI usually responds to allegations of negligent service. Public liability does not.
Part of: Professional indemnity for IT professionals
In short
Web hosting companies serve customers who depend on them completely: sole traders, shops, charities, clubs and the web designers who resell hosting to their own clients. Claims follow shared-server outages, backups that turn out to be missing, mailboxes lost in a migration, and domains or SSL certificates that lapse. Industry rules are shortening certificate lifetimes, from a 200-day maximum since March 2026 to 47 days from March 2029, so renewal automation matters more each year. PI covers negligent service, subject to the policy terms, and cyber covers attacks on your platform. Your terms and conditions help, but limits in them must be reasonable.
Last reviewed 5 October 2026 by the Apex professional indemnity team.
Web hosting customers are not technical buyers. They buy a bundle of website space, email, a domain and a certificate, often from a web designer who resells your service, and they assume it will simply keep working. Many will never look at a DNS record or a backup log. That trust is the business, and it is also the risk: when something fails, they cannot fix it themselves and they have no in-house expert to blame.
The losses are small-business losses, multiplied across many customers. A florist’s shop that cannot take orders the week before Mother’s Day. An estate agent whose enquiries bounce. A charity whose donation page shows a security warning. Public liability insurance covers injury and property damage, so it will not respond to any of these. Professional indemnity (PI) insurance covers your liability for financial loss caused by negligent service, and the cost of defending the claim, subject to the policy terms.
These scenarios are illustrative. They show common allegations against web hosts, not real claims or outcomes.
None of these involves injury or physical damage. Each is an allegation that you did not run the service with reasonable care and skill.
Many web hosting failures are not dramatic outages. They are renewals that lapse, certificates that expire and email records that break, often noticed first by the customer’s own customers.
If your plan includes managing renewals or DNS, a lapse caused by a failure in your process is the kind of allegation PI is there to defend. If the customer manages them, your terms should say so clearly.
You store material your customers publish, and sooner or later someone will complain that a hosted page defames them or infringes their copyright. Regulation 19 of the Electronic Commerce (EC Directive) Regulations 2002 protects a host from damages, other financial remedies and criminal sanctions for unlawful information stored at a customer’s request, provided that:
In practice that means a working notice-and-takedown process: a published contact point, a record of every complaint and what you did, and decisions made promptly. Hosts that also build or edit customers’ sites should be careful, because content created under your control may fall outside the defence. Removing a site on a weak complaint brings its own risk: a wrongful suspension claim from your customer. Many technology PI wordings include defamation and intellectual property cover, which can respond to both kinds of dispute, subject to the terms.
Web hosts trade on standard terms that customers accept online. Those terms do a lot of work, but they sit on top of rules that limit what you can contract out of.
| Law | What it says | Why it matters to your PI |
|---|---|---|
| Supply of Goods and Services Act 1982, s.13 (England, Wales and Northern Ireland) | In a business-to-business contract for services, there is an implied term that the supplier will carry out the service with reasonable care and skill. | The standard that claims from business customers are usually argued against. |
| Consumer Rights Act 2015, s.49 | Services supplied to consumers must be performed with reasonable care and skill. | Individuals hosting a personal site or blog have the same expectation. |
| Unfair Contract Terms Act 1977, s.3 | Where a business deals on your written standard terms, a term excluding or restricting your liability for breach is valid only if it satisfies the requirement of reasonableness. | A liability cap set too low may not survive a challenge, so do not rely on terms instead of insurance. |
| UK GDPR, Article 28 | A processor must act only on documented instructions, keep personal data secure and delete or return it when the service ends. | Customer websites and mailboxes hold personal data, which usually makes you their processor. |
| Usually covered by PI | Often excluded or limited | Needs a different policy |
|---|---|---|
| Negligent loss of website files, databases or mailboxes in your care | Service credits and refunds of hosting fees | Your own forensics and recovery after an attack on your servers (cyber) |
| Failure to renew domains or certificates where you took on that job | Uptime guarantees and other promises beyond reasonable care | Your own lost income during an outage (cyber or business interruption) |
| Errors in migrations and DNS changes | Claims brought in countries outside the policy’s jurisdiction | Damage to your own servers and equipment (property insurance) |
| Defamation and IP claims over hosted content, on many wordings | Fines and penalties, where they cannot lawfully be insured | Injury to visitors at your premises (public liability) |
| Defence costs, including technical experts | Circumstances you knew about before the policy started | Injury to your own staff (employers’ liability) |
Cover is always subject to the insurer’s acceptance and the policy terms. If you sell domains as a registrar in your own right, or build websites as well as host them, tell your insurer: both change the risk.
Shared hosting concentrates risk. One vulnerable control panel, one compromised admin account or one ransomware attack on shared storage can affect every customer on the platform at once.
Customers’ own security failures will be blamed on you too. When a site is hacked through outdated plugins the customer was responsible for, the first allegation is often that the server was insecure. Keep accounts isolated, keep logs, and make sure your PI and cyber policies between them pay to defend those claims. If you sell through resellers, check what your reseller terms say about claims from their clients.
Web hosts usually face many small customers rather than one large contract, so think about volume. A single platform-wide failure can generate dozens of claims, and an aggregate limit is shared across all of them. Agencies and larger business customers may also ask for a minimum PI limit in their contracts.
PI is claims-made, so the policy in force when a claim is made is the one that pays. Data loss may only come to light when a customer tries to restore. Hosting books are also bought and sold: if you sell your customer base, claims about your period of service can still come to you, so arrange run-off cover rather than letting the policy lapse.
A complete proposal gets better terms than a bare one, and a broker can only present what you tell us. Have these ready:
Speak to a broker
PI for web hosting companies, placed by a named broker
Start the online proposal and save it as you go, or leave your number and a named broker will call you back, usually the same working day.
Apex Insurance Brokers is an independent insurance broker based in Bristol, established in 2009 and authorised and regulated by the Financial Conduct Authority. We are not tied to one insurer: we work with over 30 markets, including Lloyd’s syndicates through wholesale brokers, and every client has a named broker who handles the placement, mid-term changes, certificates for clients and the renewal.
Yes. Small businesses rely on their host for their website, email, domain and certificates. If a failure in your service costs them orders or enquiries, they can claim that financial loss from you. PI covers negligence allegations and defence costs, subject to the policy terms; public liability does not.
No UK law requires web hosts to hold PI. In practice agencies, resellers and larger business customers may ask for it in contracts. It is worth holding anyway, because a single platform failure can produce claims from many customers at once.
It depends on who agreed to renew it. If managing renewals is part of your plan and your process fails, the customer can allege negligence, and PI may respond, subject to the terms. If the customer manages its own renewals, your terms should say so in plain words.
If your terms make the customer responsible for its own applications and plugins, the claim may fail, but you will still have to defend it. PI and cyber cover can pay those defence costs, subject to the terms. Logs and account isolation give you the evidence to answer them.
You can be named. Regulation 19 of the Electronic Commerce Regulations 2002 protects a host from damages if it had no knowledge of the unlawful content, or acted expeditiously to remove it once it knew. Many technology PI wordings include defamation and IP cover, subject to the terms.
Yes, within limits. Against business customers on your standard terms, exclusions and caps must satisfy the reasonableness test in the Unfair Contract Terms Act 1977, and consumers have separate protection. Terms reduce claims but do not stop them being made, so PI is still needed.
Apex arranges professional indemnity insurance for web hosting companies across the UK. Tell us about your work and we’ll find cover that fits. Or call 0117 325 0027.
Start your PI proposal Call 0117 325 0027Apex Insurance Brokers Limited is authorised and regulated by the Financial Conduct Authority. Registered in England and Wales, company number 07014570. This page is general information, not advice on your individual circumstances. Cover is always subject to the insurer’s acceptance and the policy terms, and this page does not guarantee that cover will be available or on what terms.
