If you are reading this because your home address, phone number or workplace just appeared somewhere you did not put it, start here. This is a response plan, not an essay, and it is ordered the way you should work through it.

Two things are true at once. Most doxxing incidents do not lead to physical harm, and attention usually peaks in the first day or two. But the information does not expire on its own. So what to do if you get doxxed comes down to two jobs: cut immediate risk in the first 48 hours, then remove and bury the information over the following weeks.

One exception overrides everything below. If the material includes a threat of violence against you or your family, or if someone has already shown up at your home or workplace, contacting law enforcement comes first. Call 911 if the danger is immediate. Everything else here can wait twenty minutes.

What this plan covers

• The short version: your first hour
• What getting doxxed actually means
• The first 48 hours: the numbered plan
• Reporting on each platform and what each one removes
• Law enforcement and what to realistically expect
• Telling your employer, school or family first
• Physical safety when your address is out
• Removing your data from brokers and people search sites
• Suppressing what cannot be removed
• What not to do
• Conclusion

The short version: your first hour

1. Check for a credible threat. If anyone has threatened violence, named a time or place, or urged others to come to your home, call the police. Everything else waits.
2. Screenshot and archive everything before it gets deleted. Capture URLs and timestamps, not just images.
3. Change your email password first, then every account that uses that email for recovery. Switch to app based two factor authentication.
4. Call your mobile carrier and add a port out PIN or number lock so nobody can steal your phone number.
5. Report the content on every platform hosting it, under the privacy or personal information category rather than generic harassment.
6. Tell one person. You should not be managing this alone, and you may need a witness later.

Do not reply to whoever posted it, argue in the comments, or publish a rebuttal. Every one of those increases the reach of the original post.

What getting doxxed actually means

Getting doxxed means someone published identifying information about you without your consent, usually to expose you to harassment or real world consequences. The common categories are your legal name if you were pseudonymous, home address, phone number, personal email, employer, school, relatives’ names, license plate, and photos of your house.

Scale matters. A comment naming your city is not the same event as a post listing your street address, your employer and your children’s school in one place. The second is what platform policies call aggregation, and every service you report it to treats it far more seriously.

Most of the information in a dox was not hacked. It was assembled from things already publicly retrievable: people search sites, voter files, property records, old posts, domain registrations, a photo with location data. That shapes your response, because removing the post is only half the job. If the underlying sources stay live, someone can rebuild the dox in an afternoon. Our guide to what doxxing is and how it happens covers the collection methods in detail.

The first 48 hours: the numbered plan

Steps one through four are time sensitive, because evidence disappears and accounts get attacked early. Steps five through eight can overlap.

Step 1: Decide whether this is a safety emergency

Read what was posted and ask three questions. Is there a stated intent to harm you? Is there a call to action aimed at others, such as an invitation to visit or confront you? Has anything already happened offline, such as a delivery you did not order, an unfamiliar car, or a police visit prompted by a false report?

If any answer is yes, call law enforcement now and tell anyone you live with tonight. Swatting, a false emergency call designed to send armed police to your address, is a real risk in high profile cases, and some departments will flag an address so calls to it get extra verification. Ask your local non emergency line.

If there is no threat and nothing offline, you have an exposure problem rather than an emergency. That is better news, and the rest of this plan is built for it.

Step 2: Document everything before it disappears

This is the step people skip and later regret. The moment you report a post, there is a good chance it comes down and the account gets deleted. That is the outcome you want, but it also destroys the evidence you need for a police report, a lawyer or a platform appeal. Spend twenty minutes capturing first, and capture context rather than bare text.

Capture this	Why it matters
Full screen capture including the browser address bar and your clock	Ties the content to a specific URL at a specific moment, which a cropped screenshot cannot do
The exact URL of every post, comment, image and profile	Platforms and search engines act on URLs. A description of where you saw it is not actionable
Account handle, display name, profile URL, and the post timestamp plus when you captured it	Links separate incidents to one person, and establishes sequence and how long content stayed up
An archived copy of each page, plus a screen recording for video, livestreams or anything that expires	Creates a third party record, and captures formats you cannot screenshot after the fact
Full email headers for any emailed threat, not just the body	Headers carry routing information investigators can use
A running log: date, time, platform, what happened, what you did	Turns scattered incidents into a documented pattern, which is what police and platforms respond to

Keep it in one folder, backed up in two places, with dates in the filenames. Capture the unflattering parts too. If you replied angrily before finding this page, screenshot that as well. Selective evidence that omits your own conduct falls apart the moment anyone checks.

Step 3: Lock down your accounts

A dox is often the opening move, not the whole attack. Once your email and phone number are public, takeover attempts tend to follow within days. Work outward from the center.

1. Your primary email first. It is the recovery route for everything else. New password, unique, not a variant of the old one.
2. Then financial and identity accounts (bank, brokerage, payment apps, password manager, mobile carrier), then social accounts, starting with any linked to your email or phone for recovery.
3. Move two factor authentication from SMS to an authenticator app or hardware key wherever possible. Text codes are the weakest form, because they travel with your phone number rather than with you.
4. Review active sessions and connected apps, sign out unrecognized devices, then check recovery settings. Attackers add their own recovery email or phone so they can return. Remove anything you did not add.
5. Read your security questions. If the answers are your mother’s maiden name, your street or your first pet, they are now public. Replace them with random strings in your password manager.

Then freeze your credit at all three major bureaus. Under federal law a freeze is free at Equifax, Experian and TransUnion, and must be placed separately at each. It does not affect existing accounts or your score, and it blocks the most common downstream damage. The Federal Trade Commission’s IdentityTheft.gov is the reference point if something has already been opened in your name.

Step 4: Close the SIM swap door

SIM swapping is when someone persuades your carrier to move your phone number to a device they control, then intercepts text codes and resets your accounts. A published phone number alongside a published address and date of birth is most of what a social engineer needs to pass a carrier’s identity check.

Call your carrier today, by phone rather than chat, and ask for three things: a port out or transfer PIN distinct from your voicemail PIN, a number lock on the line, and a note requiring in person identification for any SIM change. Every major US carrier offers a version of these. The Federal Communications Commission has adopted rules requiring wireless providers to authenticate customers before moving a number to a new device or carrier, so this is a routine request.

Warning signs it has already happened: your phone drops to no service for no reason, calls and texts stop arriving, or you get a porting confirmation you did not request. Call the carrier immediately from another phone.

Step 5: Report the content everywhere it is hosted

Report on the platform where the content lives, under the right category. That single choice is the biggest determinant of whether anything happens. A report filed as generic harassment gets weighed against the poster’s speech interests. A report filed as a private information or privacy violation triggers a narrower rule that platforms enforce far more mechanically. The next section covers this platform by platform, and steps 6, 7 and 8, meaning law enforcement, telling the people around you, and physical safety, each get a section after it.

Reporting on each platform and what each one removes

Every major platform prohibits publishing someone’s private information. What differs is the category name, who may file, and what the platform does about it. Here is the shape of it, checked against each platform’s own published policy.

Platform	The rule that applies	What to know when you report
X	Private information policy, covering home addresses, non public phone numbers and emails, government IDs, financial and medical information, and the identity of anonymous users	X generally wants the report from the person it concerns, or an authorized representative, unless the post is abusive on its face. Enforcement runs from a required deletion and a read only period up to permanent suspension of accounts whose sole purpose is posting others’ private information
Reddit	The sitewide rule against posting personal and confidential information, which also covers links to it and unredacted screenshots	Report through reddit.com/report and to the subreddit moderators. Moderators usually act fastest, admins handle account level action
Meta: Facebook, Instagram and Threads	The privacy violations section of the Community Standards, covering personally identifiable information and images of private residences	Report the specific post or comment first, then the account separately if it exists to harass you
TikTok	The privacy and security section of the Community Guidelines, prohibiting personal information that puts someone at risk	Report in app from the video or comment.
Discord	The doxxing policy, prohibiting another person’s personally identifiable information shared without permission and with intent to cause harm	Report the individual message, and the server separately if it exists for this purpose.
YouTube	The privacy complaint process, which is separate from a Community Guidelines strike	You must be uniquely identifiable in the content to file. Give the exact timestamp and say what identifies you. This is a different route from flagging for harassment, and you may need both
Google Search	The policy on removing personal information from Search results	Google removes results containing home addresses, phone numbers, emails, government ID numbers, bank and card numbers, signatures, medical records and confidential credentials. It has explicit doxxing criteria too: personal information published with threats, or a significant amount of aggregated personal information with no legitimate purpose. You supply the URLs. Removal from Search does not remove the page from the web

Four practical notes. File one report per URL, because review systems act on one piece of content at a time. Use the platform’s own wording: say the post publishes your home address without your consent, rather than that it is harassment. Keep every confirmation number, since appeals depend on them. And if a first report fails, an appeal that adds the aggregation point often succeeds.

If intimate images were published, hash based tools can get copies blocked across participating platforms without you sending the images anywhere. StopNCII.org covers adults, and NCMEC’s Take It Down covers images of people who were under 18 when the image was made. Both generate a fingerprint on your own device rather than uploading the file.

Law enforcement and what to realistically expect

To repeat the rule that overrides everything: if there are credible threats of violence, law enforcement comes first, before documentation and before platform reports. Police treat a stated intent to harm very differently from a published address.

Absent threats, the honest picture is mixed. There is no single federal anti doxxing statute in the United States. Depending on what was published and what followed, the conduct can touch state harassment, stalking and cyberstalking laws, state statutes addressing publication of personal information, and federal interstate stalking and threat provisions. Coverage varies considerably by state. Our guide on whether doxxing is illegal sets out the shape of the law without pretending it is uniform.

• You may meet an officer unfamiliar with the term. Do not lead with the word doxxing. Describe the conduct: someone published my home address and phone number and invited others to contact me, and these are the messages I have had since.
• Ask for a report number even if no charge is likely, and bring your evidence printed and organized. Employers, courts, platforms and protective order petitions all rely on a documented report, and a folder with URLs, timestamps and a chronology gets taken more seriously than a phone handed across a desk.
• Anonymity and jurisdiction both slow things down. Identifying an anonymous poster generally requires legal process served on a platform, which police pursue selectively, and your local department may have no authority over someone in another state.

You can also file with the FBI’s Internet Crime Complaint Center, but be clear on what it does. IC3 is a repository: analysts review complaints and pass information to law enforcement and partner agencies as appropriate, but it does not investigate and cannot tell you a complaint’s status. Its own guidance says to contact local law enforcement directly if your matter is time sensitive, and to call 911 if you are in immediate danger. Treat it as a supplement to a local report, not a substitute.

Two other routes exist. Many states allow you to petition for a civil protective or anti harassment order, a separate track from criminal charges with a lower standard of proof. And if the material includes false statements of fact that damage your reputation, that is a defamation question rather than a privacy one, with different remedies and a short filing window.

Telling your employer, school or family first

People who get doxxed often stay quiet out of embarrassment, and that is almost always the wrong call. These campaigns frequently include contacting the target’s employer, and an HR team that hears it first from an anonymous complaint reads the situation very differently than one you briefed.

Keep it short and operational. You are giving notice and making a request, not asking for sympathy. Something close to this: my personal information was published online without my consent, I am working through platform reports and removals, you may get messages about me from people who are not customers or colleagues, and I wanted you to hear it from me. Then make one or two specific asks: that the front desk not confirm your schedule, that inbound messages about you be forwarded rather than answered, and that your work email, direct line or photo come off the public site for a while.

For a school, the same conversation goes to administration or campus safety, and if children are involved, confirm in writing who is authorized for pickup. Family matters for two reasons: relatives are often listed in the dox itself, through the relative fields on people search sites, and they are the most likely to be contacted by someone probing for more. Tell them what happened in one sentence, tell them not to engage with anyone who contacts them, and ask them to lock down their own accounts, especially anything showing a shared address or photos of your home.

Physical safety when your address is out

Take these in proportion to the actual risk. Most people who do them never need them, and doing them lowers the background anxiety considerably. Moving house is almost never the right answer in the first 48 hours: that decision belongs to a calmer conversation with law enforcement and the people you live with, once the immediate wave has passed.

• Tell people who share your building. A neighbor who knows to expect unusual visitors or deliveries is the best early warning system you have.
• Route deliveries away from home for a while, to work, a parcel locker or a mailbox service. Unwanted deliveries ordered in your name are a common tactic, and they confirm the address is current.
• Secure your mail with a locking mailbox and an account with your postal service, so nobody can redirect it before you do.
• Check what your home looks like online. Street level imagery can usually be blurred on request, and old listing photos of your interior can often be removed by contacting the real estate site.
• Audit your own posting habits. Turn off location tagging, post photos after you leave a place, and check older posts for a house number, street sign, school uniform or license plate.
• Check your state’s address confidentiality program. Most states run one, usually through the secretary of state or attorney general, giving a substitute legal address for public records plus mail forwarding. Eligibility is typically limited to victims of domestic violence, stalking, sexual assault or trafficking, so it will not fit every case.

Removing your data from brokers and people search sites

This is the part that actually reduces long term exposure, and the part most people abandon because it is tedious. Taking down the post removes one copy. Removing the broker listings removes the supply. People search sites publish current and former addresses, phone numbers, relatives and age, assembled from public records and purchased data. They are the first stop for anyone building a dox, and they refresh from their sources, so no opt out is permanently final.

1. Search your own name in quotation marks with your city, then your phone number and email. Note every people search site that returns a result, with the listing URL. That is your work queue.
2. Start with the largest aggregators, since smaller sites often license from them. Our guides cover the Whitepages opt out and the Spokeo opt out, which between them account for much of what surfaces on a first page.
3. Use a dedicated email address for opt outs, since many require confirmation, and keep a tracking sheet: site, listing URL, date requested, confirmation received, date verified removed, date to recheck. Without one you lose track by the tenth site.
4. Then file Google Search removals for any URL still showing covered information, including cached results for pages already taken down. Google’s Results About You tool also monitors for your contact details in Search and prompts you to request removal.
5. Recheck in 60 to 90 days, because listings reappear when a broker re ingests a record. This is maintenance, not a one time project.

California residents have a shortcut. Under the state’s Delete Act, the California Privacy Protection Agency runs a Deletion Request and Opt Out Platform, known as DROP, which lets a verified consumer submit one deletion request that registered data brokers must honor. Brokers were required to begin processing requests from that list in August 2026 and to check it at regular intervals. It does not cover sites that are not registered brokers, but it removes a lot of the repetition.

If your home address is the exposed item, it needs its own pass across property records, voter registration, domain privacy, old resumes and mapping services. Our guide to removing your address from the internet works through each source in turn.

Suppressing what cannot be removed

Some material will not come down: a forum with no working abuse contact, a host that ignores requests, an article a publisher considers newsworthy, or a screenshot reposted so widely that chasing every copy costs more than it is worth. Then the goal shifts from removal to visibility.

Suppression means making surviving material hard to find rather than making it not exist. It works because almost nobody looks past the first page of results for a name, and because search engines rank fresh, authoritative, well linked pages above stale forum threads. In practice that means building properties you control for your own name: a personal site, a complete professional profile, published work under your byline. It is slow, and movement is measured in months, not weeks. Anyone promising a cleared first page in days is selling something that does not exist.

Two cautions. Do not create fake accounts or filler pages to push results down, because search engines recognize that pattern and the cleanup is worse than the original problem. And never link to, quote or rebut the doxxing post, since that helps it rank. Where this gets genuinely difficult, on a stubborn high ranking page or a campaign across several sites, it becomes a specialist job, and it is the core of what online reputation management services exist to do.

What not to do

• Do not engage with the poster. Replies, quote posts and angry messages feed the algorithm and hand the other side material.
• Do not dox them back. It turns you from complainant into participant, undermines every report you have filed, and can expose you to the same legal risk you are trying to invoke.
• Do not delete your accounts in the first 48 hours. Deactivating destroys evidence and forfeits your handle. Lock them to private instead and decide later.
• Do not post a public statement without a specific reason, since it usually introduces the story to people who never saw it. And do not pay anyone who offers to remove the post for a fee, especially if the offer comes from the poster or an account that appeared right afterward.
• Do not try to handle it alone. These campaigns work on isolation, and the distress is real even when the physical risk is not.

Conclusion

Being doxxed feels like losing control, and the plan above is about taking pieces of it back in order. Document before you report, because evidence vanishes. Secure your email and your phone number, because everything else swings on those. Report under the privacy category on every platform hosting the content. Involve law enforcement first if there are threats, and file a report anyway if there are not, for the record it creates. Tell your employer and your family before someone else does. Then do the slower, duller, genuinely effective work of clearing the data brokers and rebuilding what shows up for your name.

The intensity of the first two days is not the shape of the whole thing. Attention moves on faster than it feels like it will. What persists is the underlying data, and that is the part you can methodically remove. Work the list, keep your log, recheck on a schedule, and ask for help with the parts that need it.