Responsibility of Malware on the server belongs to the owner of the website. This is because, from the hosting provider’s point of view, they only provide you with the infrastructure for your website. If you uploaded a website, which allows malware or phishing sites to be uploaded to it, then it is your responsibility to remove the Malware.
Most web agencies or programmers provide some basic guarantee to remove malware from the server within a reasonable period of time. Over time, as the hosting login belongs to the customer, the web agency cannot be held accountable, because they won’t know who else has access or uploaded anything to your server.
As such, we recommended considering the additional security packages. If your website is having Malware issues, please contact your Account Manager or Project Manager to find out about our guaranteed security package.