Online harassment does not arrive as one clean message. It arrives as a pile of small ones: a reply that vanishes when the account is suspended, a thread that gets deleted overnight, a screenshot of your face captioned with your workplace. By the time you decide to report it, the evidence you assumed was saved often is not. Platforms do not keep everything, and they do not share everything with you. If you want a report to mean anything, you need to build your own record before you click the button.
The habit of writing things down is borrowed from stalking guidance, where the advice has been consistent for decades: record what happened, when it happened, and who saw it. The same discipline applies to sustained harassment campaigns, because the pattern across messages is the evidence, not any single message. A platform moderator looking at one insult will see rudeness. Looking at a dated log of thirty messages across three accounts, they see a campaign.
Why the Record Comes First
You might think a report is a simple thing: you click the button, paste a screenshot, and the platform handles the rest. That is not how it works. Platform moderation teams receive a high volume of reports daily, and the automated systems that triage them are looking for keywords, not context. A report that says "this account is harassing me" with no supporting detail is likely to be closed as unsubstantiated. A report that says "this account sent me six messages over three days, here are the URLs, here is the log" gives the reviewer something they can act on.
The record also protects you. If the harassment escalates, you will need to show a pattern to the police, a lawyer, or an employer. You cannot reconstruct that pattern from memory. Memory compresses, reorders, and forgets. A dated log does not.
Start Before You Feel the Need
Most people begin documenting after a threat, when the record is already thin. By then, the context has been deleted, the screenshots are lost in a chat, and the timeline has holes. The better time to start is the moment you notice a pattern. That does not mean documenting every rude comment you have ever received; it means picking the point where a stranger's behaviour shifts from annoying to targeted. If someone is replying to you repeatedly, referencing things you posted weeks ago, or coordinating with other accounts to respond to you at once, that is the threshold.
The distinction matters because the advice changes at that threshold. For low-level provocation, disengagement is the whole answer. For organised targeting, disengagement alone does nothing, because you were never the audience. The site's escalation levels make this explicit: once the behaviour is coordinated, documentation and reporting become the real moves. So start the paper trail when you first think "this is weird", not when you think "this is dangerous".
Capture the Whole Context, Not Just the Insult
The most common mistake is screenshotting the offending message and nothing else. A single message without its surroundings is almost worthless. You need the context that proves the message is directed at you: the reply chain, the thread title, the post you were responding to, the account names of everyone involved. Screenshot the entire conversation, scrolling from the top of the relevant exchange to the bottom. If the platform shows timestamps, include them. If it shows view counts or engagement numbers, include those too, because they show the reach of the harassment.
Take a screenshot of the profile of the person or people involved: their handle, display name, bio, join date, and follower count. This matters because accounts are suspended and recreated constantly. A record of the account at the time of the incident lets a moderator connect the behaviour to the person behind it. Without that, a suspended account is just a blank space.
Record the Metadata That Screenshots Hide
Screenshots capture pixels, not data. The URL of the message or thread is the single most important piece of metadata you can save, because it lets anyone verifying your report return to the original even if the screenshot is challenged. Copy the URL of each message, each profile, and each thread. Paste them into a notes file with the date and time you captured them.
Platforms also treat the report differently when you can name the specific account and give a URL than when you paste a screenshot with no location. The report form becomes a different animal. A screenshot can be dismissed as edited; a URL that still resolves, or an archived copy of it, cannot.
Archive What Can Be Deleted
Screenshots and URLs are not enough on their own, because the person harassing you can delete their account, or the platform can remove the content for a policy violation, and your URL goes dead. That is why archiving services exist. A service like the Wayback Machine or a similar web archive will store a copy of the page at a given URL, and the archived copy is timestamped by a third party. You do not need to rely on the archive for every message; you need it for the pages that matter most: the profile pages, the longest thread, the post that received the most engagement.
If you cannot archive a page because it is behind a login, save the full HTML of the page from your browser. On most browsers, "Save Page As" will give you a file that preserves the structure of the page, including the URLs and text, even if the styling is lost. That file, together with a screenshot, gives you two independent records of the same moment.
Keep a Simple Log With Dates and Witnesses
The most underrated piece of documentation is a plain text log. Open a file and write, for each incident: the date and time, the platform, the account involved, a one-line description of what happened, and the names of anyone who saw it or replied. This log does not need to be polished. It needs to be consistent.
The log is what turns a pile of screenshots into a timeline. It shows frequency, escalation, and the involvement of multiple accounts. It also helps you notice patterns you might otherwise miss: the same person following you across platforms, the same talking points appearing from different accounts, the timing of messages after you post. That kind of pattern is what distinguishes a harassment campaign from a string of bad days.
Know What Platform Filters Catch and What They Miss
Platforms do have automated systems, and they catch a surprising amount of obvious abuse. But the filters are looking for keywords, not context. They catch "I will kill you" and miss the coordinated pile-on that is far more damaging. They catch a banned word and miss the doxxing that uses a slight misspelling of your address. If you understand what platform filters actually catch, you know what you need to document manually. A report that says "this account sent me six messages over three days, here are the URLs, here is the log" gives the human reviewer something the filter cannot see. The platform's own reporting guidance usually explains what its filters catch and what they do not; read it before you file, so your report speaks the platform's language.
File the Report With the Record Attached
When you report, attach everything you have: the screenshots, the URLs, the archived pages, and the log. Do not assume the platform will investigate on its own. A report with a single screenshot is a guess; a report with a dated log, multiple URLs, and an archive is a case. The difference is the difference between a spam complaint and a credible account of sustained harassment. The platform reporting process is the place to put that case.
If the harassment crosses into doxxing, stalking, or threats of violence, the platform is not the only place to file. Contact the relevant authorities, and give them the same record. The paper trail you built is what lets them take the report seriously. It is also what protects you if the harassment escalates, because you will not have to reconstruct months of abuse from memory.
The point of the paper trail is not to win an argument. It is to make the behaviour legible to someone who was not there. A moderator, a police officer, a lawyer: they all need to see the pattern in minutes. Your job, before you report, is to make that possible.