The short answer. Do not engage. Save everything. Then work the routes that do not need a lawsuit: copyright, the host's rules, Google's policies and the police for threats or extortion. Talk to a lawyer early, because California's deadline to sue for defamation is generally one year.
1. Do not respond, at least not yet
Attack sites are built to provoke. A public reply, angry email or comment usually gives the attacker more material, more traffic and proof that the attack is working. Take a breath. Nothing you do in the first hour will fix it, and the wrong move can make it worse.
2. Preserve the evidence
Before you report anything, capture the site as it is today. Sites change or vanish once reports start, and you may need proof later.
- Full page screenshots of every page, showing the address bar, date and time
- PDFs of each page saved from your browser
- Comments, images, linked social media accounts and any payment or contact links
- Messages you received, including any demand for money
- A simple log of dates: when you found it, who told you, every report you file
Keep copies somewhere private. Think twice about public archive services, because they create another public copy of the content.
3. Find out who hosts the site
Look up the domain with ICANN Lookup. Even when the owner's identity is hidden, the record shows the registrar, and tools such as hosting lookups usually reveal the hosting company. Both have abuse contacts.
Hosts rarely remove content just because it is false. They are much more likely to act when content breaks their rules in a specific way. Report it under the rule it actually breaks:
| What is on the site | Report it as |
|---|---|
| Your home address, phone, family details | Doxxing or harassment |
| Threats of violence | Threats, and also to police |
| Photos you took yourself | Copyright infringement, with a DMCA notice |
| Intimate images | Nonconsensual intimate imagery |
| A demand for money to remove it | Extortion, and also to police |
| Pretending to be you | Impersonation |
4. Use copyright if your photos are on it
If the site uses a photo you took, including a selfie, you usually own the copyright. Section 230 does not protect sites from copyright claims, and hosts in the United States have strong reasons to respond to a proper DMCA takedown notice. This is often the fastest legal tool available. Note that a DMCA notice includes your contact details, which the host may pass to the site owner.
5. Work the Google removal routes
Even if the site stays up, removing it from searches for your name limits the damage. Our guide to removing content from Google covers doxxing, pay to remove sites, intimate images and court orders.
6. Report crimes
Threats, stalking, extortion and doxxing meant to cause harassment can be crimes in California. Report them to your local police and keep the report number. Online crimes can also be reported to the FBI at ic3.gov. See our guide to doxxing under California law.
7. Talk to a lawyer early
In California, a defamation claim generally must be filed within one year of publication. A lawyer can tell you whether you have a claim, send a demand letter, help identify an anonymous poster, and seek a restraining order if the person is harassing you. Ask about the risk of an anti SLAPP motion before filing anything.
8. Take care of yourself
Being publicly attacked is exhausting and isolating. Tell people you trust what is happening before they find it on their own. The Cyber Civil Rights Initiative offers support for people facing online abuse.