Do you charge clients whose websites have been hacked?

The question is - did you build the database cannection code and server behaviours using mysql, (such as used by the Dw server behaviours) in the last 10 years?

If the answer is yes, then you are responsible for the problem. PHP issued a security notice about using mysql back in 2009/10, saying that the mysql database connection code was insecure and should NOT be used. Instead developers should use mysqli or pdo to connect-to and query a database.

If you did use mysql, (and not mysqli/pdo) and the site was built in the last 10 years, then the client could also ask you to rebuild the server side, for free. Simply because you as the developer are legally responsible to build a site that is, 'fit for use'. Which includes not using out-of-date and insecure code.

Well it depends if you feel you have done your best in terms of producing code which is secure against hacking attacks. Was the attack down to weakness in the code or a weakness in the server security. You have to make your own mind up who is at fault and who should pay.

I largely gave up web-development because I was spending too much unpaid time sorting out issues which were beyond my control and would have been hard to justify to the client why I charged them.

I would advise to make a charge as nothing can be guaranteed 100% especially if you feel it was something beyond your control. Clients need to set aside a contingency budget for unexpected events.

I've literally spent days of my time sorting out what was the fault of the hosting company and not charged the client, because its not the clients fault. If the client gives you regular work and its good paying work you can do it for free but like most freelance developers I suspect your doing work for the price of a hamburger and fries in which case you might as well get a decent job doing something that pays, without all the hassle associated.