Responding to online harassment: documentation, reporting, and protecting yourself

Online harassment ranges from a sustained stream of abusive replies to coordinated campaigns involving doxxing, impersonation and threats. The advice people receive is usually some combination of "ignore it" and "report it" — neither of which is much help when it is happening to you.

This guide is about the practical mechanics: what to do first, how to build a record that gets acted on, and how to reduce your exposure without withdrawing from public life entirely.

If you are in immediate danger, contact your local emergency services. Threats of physical violence, and content suggesting someone knows where you live, are matters for the police rather than a moderation queue.

The first hour

Instinct says to reply, or to delete everything. Both usually make things worse — replying supplies the attention the behaviour seeks, and deleting destroys evidence.

Do these five things instead.

1. Do not engage. No reply, no quote, no screenshot with commentary. In coordinated harassment, a response is the reward and it recruits participants. This is genuinely hard and it is still the right call.

2. Capture evidence before it disappears. Accounts get deleted and posts get edited. See the next section — this is the step everything else depends on.

3. Tell one other person. Harassment is isolating and isolation impairs judgement. A friend who can look at the material with you, and who can take over the monitoring, is worth more than any tool.

4. Secure your accounts. Harassment campaigns frequently escalate to account-takeover attempts. Change your password, turn on a strong second factor, and check that no unfamiliar recovery methods have been added.

5. Then report and block — in that order. Reporting after blocking is harder on some platforms, because the content may become invisible to you.

An incident response runbook

Use this sequence during an active incident. If a message contains a credible threat or reveals your location, skip to emergency help and police; do not wait for a platform response.

When	Action
First 10 minutes	Move to a safer place if needed. Tell one trusted person, stop replying, and capture the original posts, profiles, and URLs before blocking or reporting.
First 30 minutes	Ask your trusted person to monitor incoming activity. Secure your email and social accounts: change reused or exposed passwords, enable your strongest available second factor, and check recovery methods and active sessions.
First hour	Record each incident in a log, report each item under the closest matching policy category, and save the report reference numbers. Block or restrict the accounts after capturing evidence.
After the first hour	Check for new threats or attempts to expose personal information. Escalate credible threats, stalking, intimate-image abuse, or targeting of a minor to local authorities or a specialist support service. Set a time to review updates rather than monitoring continuously.

Evidence preservation checklist

For each incident, preserve a copy outside the platform and note:

• Full, unedited URL and the platform name.
• Account handle, display name, and numeric account ID if available.
• Complete screenshot showing the post in context, address bar, and device clock; avoid cropping or annotating the original.
• Timestamp and timezone, plus when you captured the evidence.
• Screen recording for disappearing content, live streams, or interactions that cannot be reopened.
• A short factual description of what happened and any linked accounts or repeated wording.
• Platform report category, submission date, and reference number.
• Original file stored in a private location with access limited to you and any trusted adviser.

Keep originals unchanged. If you need to redact material before sharing it, make a separate copy and retain the original. Do not forward intimate images or expose another person's private information while collecting evidence.

Documentation that actually works

This is the part most people do badly, and it determines whether anyone can help you.

Capture the full context, not a cropped screenshot. A crop of the words is nearly useless. You need:

• The full URL of the post or profile.
• The account handle and display name, and the numeric user ID if the platform exposes it — handles get changed specifically to break evidence trails.
• The timestamp, with your timezone noted.
• A screenshot showing the browser address bar and the system clock in the same frame.

Record video for anything ephemeral. Stories, disappearing messages, and live streams need screen recording.

Keep a log. A simple spreadsheet: date, time, platform, account, what happened, the URL, the evidence filename, and any report reference number you received. If this becomes a police matter or a legal one, this log is the single most valuable thing you will have. It also converts an overwhelming experience into something with structure, which helps more than you would expect.

Store it outside the platform, in cloud storage or on a drive. Do not rely on the service that hosts the abuse to retain the evidence of it.

Note the pattern, not just the incidents. Where harassment is coordinated, the pattern — many new accounts, identical phrasing, synchronised timing, a linked off-platform thread — is what elevates a report from "individual rude comment" to "organised campaign". Platforms have separate and more effective processes for the latter, and they will not find the pattern for you.

Reporting effectively

Report under the right category. Moderation is policy-specific and routed by category. A report filed as "spam" for a credible threat may go to a queue that cannot act on threats. Read the options and pick the one matching the actual violation: threats of violence, targeted harassment, hateful conduct, non-consensual imagery, impersonation, doxxing.

Report each item separately, but reference the pattern in the description field where one is offered. One report about forty incidents is usually processed as one incident.

Be factual. Reviewers are working at speed against a policy document. "This account has posted my home address in four replies since 14 August, URLs below" gets action.

Escalate when the first outcome is wrong. Most platforms have an appeals process, and appealed decisions are often reviewed by more experienced staff. Automated first-pass moderation gets things wrong regularly; an appeal is not a formality.

Look for the specialised channels. Many platforms have dedicated escalation routes for non-consensual intimate imagery, doxxing, and threats — separate from the general report button and much faster. There are also independent services that help get intimate images removed across multiple platforms at once, including tools operating on hashes so you never have to send the image to anyone.

Reducing your exposure

The goal is raising the cost of targeting you, not vanishing.

Audit what is publicly discoverable. Search your own name, handles, phone number and email. Check old accounts, forum posts, and public records. Attackers do this first; you should know what they will find.

Remove yourself from data brokers. People-search sites aggregate home addresses, relatives, and phone numbers, and are where doxxing material usually originates. Each has an opt-out; they are tedious but effective. Under GDPR or CCPA you can also make a formal deletion request — see our guide to data rights.

Strip metadata from photos. Images can carry GPS coordinates. Most platforms remove it on upload; files sent directly often do not.

Watch for background detail. House numbers, street signs, school uniforms, distinctive views, package labels. Coordinated harassment groups treat location identification as a game.

Separate your identities. Different email addresses for public-facing accounts and for banking or recovery. This limits how far a compromise of one can travel.

Use the graduated tools, not just blocking. Most platforms now offer more than block/don't-block: limiting replies to people you follow, hiding replies, muting keywords, filtering messages from new accounts, and temporarily restricting interaction to your existing connections. During an active campaign, a temporary lockdown is often more effective than blocking accounts one at a time faster than they can be created.

When to involve the police

Escalate offline when there is:

• A credible threat of violence to you or your family.
• Evidence the person knows where you live or has appeared there.
• Non-consensual intimate imagery, which is a criminal offence in many jurisdictions.
• Sustained stalking behaviour, which in many places is itself an offence distinct from any single message.
• Harassment involving a minor.

Bring your log. Expect a variable response — familiarity with online offences differs enormously between forces — and ask for a crime reference number regardless, as it creates a record that matters if the behaviour escalates.

Evidence map by platform and law-enforcement handoff basics

When presenting evidence to law enforcement or legal counsel, screenshots alone are frequently rejected as easily fabricated. You must build an evidentiary chain that connects digital acts to specific accounts and timestamps:

Platform-specific evidence capture map

Platform	Key identifiers to capture	How to preserve technical metadata	Platform preservation request route
Social services	User ID, post permalink, message thread ID, where available	Use the service's copy-link option; capture the full URL and visible account identifiers.	Consult the service's current law-enforcement guidance for preservation and legal-process requirements.
X (Twitter)	Screen name (@handle), immutable numeric User ID (via account lookup tool), Tweet ID	Save full tweet URL (/status/123...); view page source to capture tweet JSON payload and UTC timestamp.	X Law Enforcement Guidelines (legal@x.com). Request immediate temporary 90-day preservation.
Discord	18-digit Discord Snowflake ID (User ID, Message ID, Server/Channel ID)	Turn on Developer Mode (User Settings → Advanced → Developer Mode). Right-click user/message → "Copy ID".	Discord Trust & Safety (dis.gd/request). Raw message IDs allow Discord to pull internal server logs even if message is deleted.
Reddit	Username, post permalink, comment ID (t1_xxxx), subreddit modmail thread	Click "Share" → "Copy link" to get canonical URL; copy raw markdown source where available.	Reddit Legal Process Guidelines (legal@reddit.com).
SMS / Phone Calls	Full incoming phone number with country code, telecommunication carrier, call duration	Export carrier billing statement showing call records; preserve original SMS threads on handset (do not delete text thread).	Local subpoena to mobile carrier for CDR (Call Detail Records) and IP gateway logs.

Law-enforcement handoff dossier structure

Deliver a physical binder or indexed PDF packet containing:

1. Executive incident summary (1 page): Chronological summary of threat type, escalation level, immediate physical risk factors, and known suspect identifiers.
2. Chronological incident log: Date, exact time (including time zone), platform, specific URLs, perpetrator handle, and summary of violation.
3. Primary evidentiary exhibits: Uncropped screenshots showing system clock and URL bar, paired with printed full text copies and hash-verified media files.
4. Platform reference numbers: Case IDs and support ticket numbers showing where reports have already been filed with platform trust & safety teams.
5. Formal preservation request notice: Ask the investigating officer to issue an official 90-day preservation request under applicable law (such as 18 U.S.C. § 2703(f) in the US) to prevent server logs from cycling out before a subpoena can be issued.

Many countries also have specialist helplines and charities for online abuse; they can advise on both the platform and legal routes and often know which contacts actually work.

Looking after yourself

The mental health dimension is not a footnote. Sustained harassment produces anxiety, sleep disruption, and hypervigilance regardless of how resilient you are.

• Delegate the monitoring. Have a trusted person triage notifications and surface only what needs your decision. This is the single most protective step available.
• Set boundaries on checking. Reading everything, compulsively, is not diligence — it is harm you are administering to yourself. The evidence is being captured; you do not need to read it live.
• Do not read the replies during an active campaign. Turn off notifications from people you do not follow.
• Talk to someone qualified if it is affecting your sleep, work, or relationships. Being targeted by strangers online is a legitimate reason to seek support.

What platforms owe you

Reasonable expectations, so you know when to push:

• A clear reporting route for each category of abuse.
• Acknowledgement that your report was received.
• Action within a defined timeframe, with faster handling for threats and intimate imagery.
• An appeal against a decision, reviewed by a human.
• Tools to protect yourself in the meantime.

Where a platform fails to provide these, that failure is worth naming. In the EU, the Digital Services Act creates specific obligations around notice-and-action and appeals, and national regulators accept complaints about non-compliance. Several other jurisdictions have online-safety regulators with comparable powers.

You are not obliged to accept harassment as the price of being online.