All guides
    Triage6 min read

    The first 48 hours after a leak

    You found your content somewhere you did not put it. Here is the order to do things in, starting with the two that matter most and ending with the ones that can wait.

    Read this first

    What happened to you is common, it is not your fault, and it is reversible more often than it looks right now. Work through the list below in order. The first two steps take about twenty minutes between them and they are the ones that matter most; everything after that can be done tomorrow if today is too much. Nothing on this page requires an account, a payment or a decision about a service.

    Step 1 — Capture the evidence before you report anything

    Reporting sometimes gets a page removed quickly, which is the outcome you want and also destroys the proof that it existed. Capture first, then report. Ten minutes now saves an argument later.

    • Copy the full URL of every page where your content appears. Copy the address bar, not a shortened link.
    • Screenshot each page whole, with the URL and the date visible in the shot.
    • Note the view count, upload date and any username that posted it.
    • Save everything in one folder named for the date. One folder per incident.

    Step 2 — Find out how far it has spread

    Knowing the size of the problem changes what you do next. A single forum post and a set mirrored across nine aggregators are different situations and need different orders of attack.

    • Search your stage name in quotes, then your name plus the word leak, then your usual post titles.
    • Search the aggregators directly rather than relying on search results — plenty of pages are never indexed.
    • Check whether a mirror exists on a second site. Aggregators copy each other within days.
    • Write down the count. It is the number every later decision is measured against.

    Step 3 — Send the first notices

    Notices go to the host, not to the person who posted. The host is the party with the ability to remove the file and the legal reason to care. Group your URLs by domain and send one notice per domain rather than one per URL.

    • Find each host's abuse contact — check the site's /dmca or /abuse page first, then the domain's registry record.
    • Write one notice per host, listing every URL on that host.
    • Include all six elements a valid notice needs, and sign it.
    • Send from an address you monitor, and keep a copy of what you sent and when.

    Step 4 — Ask search engines to delist

    Delisting is a separate route from removal and it works even when the host ignores you. It hides the page from results for your name, which is where most people find leaks, while the page itself stays online. File it alongside the host notice rather than after it — waiting for the host wastes the days that matter most.

    • File a copyright removal request with Google for each URL, listing them in one submission.
    • If the material is intimate and was published without your consent, use the dedicated non-consensual imagery route instead. It moves faster and does not ask you to prove ownership.
    • Repeat for Bing, which uses a separate form and no bulk route.

    Step 5 — Things that can wait until the panic passes

    • Change the password on every platform you post from, and turn on two-factor authentication.
    • Check whether the leak came from a shared login, a screen recording, or a scraper — it changes what you do to stop the next one.
    • Tell your manager or agency, if you have one, so they are not surprised by it.
    • Put a weekly reminder in your calendar to re-check. Aggregators re-scrape, and the same set usually comes back at a new address.

    What not to do

    • Do not contact the uploader or the forum. It rarely helps, and it tells a community that you are watching.
    • Do not pay anyone who contacts you offering removal. Approaches that arrive right after a leak are usually the leak's beneficiaries.
    • Do not delete your own originals. They are your proof of authorship.
    • Do not assume a removed page is gone for good. Re-check the URL in a week.

    If you want the rest of it handled

    Everything above works and openDMCA publishes it in full because it is what you should do first. What does not scale is repeating it every week across thirty hosts. openDMCA finds the copies, files the notices, requests delisting, and re-checks whether anything came back. Start with the free tools if you would rather do it yourself.

    Work through it as a checklist

    23 steps

    Step 1 — Capture the evidence before you report anything

    Step 2 — Find out how far it has spread

    Step 3 — Send the first notices

    Step 4 — Ask search engines to delist

    Step 5 — Things that can wait until the panic passes

    What not to do

    Your ticks are saved in this browser, on this device, and openDMCA never sees them. Seeing the same checklist ticked on your phone and your laptop needs an account, because a browser cannot sync to a device it does not know about. What an account costs.

    Automate all of this

    Skip the manual work — openDMCA detects leaks, files the notices, requests search delisting, and keeps re-checking for reuploads.