How to Document Online Harassment: A Complete Evidence Guide

Online harassment — whether it takes the form of threatening messages, defamatory posts, coordinated pile-ons, cyberstalking, or non-consensual sharing of intimate images — causes real harm. It can affect employment, mental health, personal safety, and relationships. And in a growing number of cases, it leads to formal proceedings: police reports, restraining orders, civil claims, workplace investigations, or platform enforcement actions.

When it gets to that stage, evidence matters enormously. The difference between a successful police report and a fruitless one, between a restraining order granted and one denied, often comes down to the quality and credibility of the documentation presented. This guide explains how to document online harassment in a way that is taken seriously — by police, by lawyers, and by courts.

Why You Need to Act Before It Disappears

The most important thing to understand about online harassment evidence is that it is time-critical. Harassing content can be deleted at any moment — sometimes within minutes of posting, when the perpetrator realises they have overstepped, or in anticipation of a report. Once content is deleted, it is generally gone from public view and extremely difficult to recover without legal process directed at the platform.

This means that the single most important action for anyone experiencing online harassment is to capture the evidence before doing anything else. Before you report to the platform. Before you contact the person. Before you take legal advice. Capture first, then act.

This is counterintuitive for many people, who want to report or respond immediately. But once you make a report to a platform, the content may be removed as part of the investigation process — and your evidence may be gone. Capture it first.

What to Capture

When documenting online harassment, the goal is to create a comprehensive record that tells a coherent story. Individual pieces of content, viewed in isolation, may seem ambiguous. A pattern of behaviour, documented systematically, is much harder to dismiss.

For each piece of harassing content, capture:

• The content itself. The message, post, comment, image, or video that constitutes the harassment.
• The account or identity behind it. The profile name, username, handle, profile photo, bio, and any identifying information visible on the account. Capture the full profile page, not just the individual post.
• The context. What platform it appeared on, in what context (a public post, a private message, a comment thread), and what else appeared around it.
• The timestamp. When the content was posted, and when you captured it. Both matter — the original posting time establishes the timeline of the harassment; the capture time establishes when you first documented it.
• The URL. The specific URL of the post, comment, or profile page. This is the source reference that allows the content to be located independently, or confirmed to have been deleted.

Beyond individual captures, maintain a chronological log of all incidents — date, platform, account, nature of the content, and what action (if any) was taken. This log becomes the narrative backbone of your evidence package.

How to Capture Evidence Defensibly

"Defensible" evidence is evidence that can survive challenge. In any formal proceeding — a police report, a civil claim, a workplace investigation — the person accused of harassment will likely deny the content, claim the captures are fabricated, or argue that the context was misrepresented. Defensible evidence is evidence that addresses these challenges through its inherent properties, not just through your word.

Use a purpose-built capture tool, not manual screenshots

Manual screenshots — whether from a keyboard shortcut or the operating system's built-in tool — produce files with no embedded metadata about the source, no verifiable timestamp, and no cryptographic proof of authenticity. They can be edited, and the opposing party will argue they were. A purpose-built evidence capture tool embeds source URL, timestamp, and a cryptographic hash at the moment of capture, creating a self-authenticating record.

Capture the full page, including the URL bar

A cropped screenshot of just the harassing content, with no visible URL or account name, is much weaker as evidence than a full-page capture that shows the complete context. Always capture the full page — the browser URL bar, the account name, the post timestamp, and any surrounding content that establishes the context.

Do not edit, crop, or annotate captures

Once a capture is made, do not alter it in any way. Do not crop it, add annotations, or adjust the image. Any alteration breaks the chain of custody and provides grounds for authenticity challenge. If you want to highlight something for a police officer or lawyer, do so separately — point to it in the unmodified capture, or provide an annotation on a copy while retaining the original.

Archive the pages independently

Submit key pages to the Wayback Machine (web.archive.org) at the time of capture. This creates an independent third-party archive of the content at that URL at that time. If the content is later deleted and the platform denies it existed, an archived version provides corroborating evidence from an independent source.

Organising Evidence for Police or Legal Proceedings

Police officers and lawyers receiving harassment complaints frequently encounter disorganised evidence: messages forwarded from one app to another, screenshots in random order across a phone camera roll, no dates, no context. Well-organised evidence gets taken more seriously and processed more efficiently.

Structure your evidence package as follows:

1. A written summary. One to two pages describing the harassment: who the perpetrator is (or appears to be), when it started, what platforms have been involved, what the nature of the harassment is, and what impact it has had. Attach references to your captured evidence at each point.
2. A chronological log. A spreadsheet or document listing each incident in date order, with the date, platform, account, nature of the content, and the corresponding evidence file.
3. The evidence files. Organised by date, labelled clearly (e.g., 2026-04-01_instagram_threatening-comment.png), with any associated metadata files.
4. Identity evidence. Your captures of the perpetrator's profile pages, showing the account name, profile photo, and any identifying information. If you have information linking the account to a real person, document it here.

What Authorities Need to Act

Understanding what police and courts need can help you prioritise your documentation efforts. The threshold for police action on online harassment varies significantly by jurisdiction and the nature of the harassment. Threatening content — particularly content that threatens physical harm, or that constitutes stalking behaviour — is generally taken more seriously than general abuse or defamation.

For police action, the most useful evidence is: clear, unambiguous threatening or harassing content; evidence linking the account to a real person; a pattern of behaviour rather than a single incident; and a contemporaneous record showing you documented it as it happened rather than retrospectively.

For legal proceedings — civil claims, restraining orders — the authentication requirements are higher. Courts increasingly require evidence that meets formal authentication standards: verified source URLs, timestamps from the capture software rather than the file system, and chain of custody documentation.

How WebInvestigator Makes This Straightforward

For most people experiencing online harassment, the process of documenting evidence is unfamiliar and stressful. The technical requirements — metadata, cryptographic hashes, chain of custody — sound daunting. WebInvestigator makes the technical side automatic, so you can focus on the investigation rather than the documentation process.

With WebInvestigator installed in your Chrome browser, capturing a piece of harassing content takes one click. The extension automatically records the full URL of the page, generates a SHA-256 hash of the captured image at the moment of capture, timestamps the capture in UTC, and logs the capture as part of your investigation case. Every capture goes into an organised, per-case evidence log that can be exported as a complete package — with files, metadata, and chain of custody record — when you are ready to present it to police or a lawyer.

The hash means that if anyone later claims the captures were fabricated or altered, you can demonstrate mathematically that the files are unmodified from the moment of capture. The chain of custody log means you have a documented record of who captured what and when. These are the tools that make evidence self-authenticating — and that give police and lawyers confidence in what you have brought them.

If you are experiencing online harassment, start capturing now. The earlier you start, the stronger your evidence will be. WebInvestigator installs in thirty seconds and is free to start using. It will not undo the harassment, but it will make sure that what you have documented is evidence that can actually be acted on.