Removing a WordPress attack blog depends on one fact you need to establish first: whether it sits on WordPress.com, where Automattic hosts it and has an abuse process, or on self-hosted WordPress software at a hosting company, where the routes run through that host, the domain registrar and the copyright system.
Key facts
- WordPress.com is a hosting service run by Automattic with a published abuse process, while self-hosted WordPress is free software with no central authority behind it.
- The technical record settles which you are dealing with: the registrar, the nameservers and the host the domain resolves to.
- Automattic acts on its user guidelines for threats, targeted harassment, doxxing, impersonation, non-consensual intimate imagery, malware and phishing.
- Section 230 of the US Communications Decency Act means an American host is not liable for a user’s defamation, so a court order or the author is the route there.
- Copyright is the one rulebook that works on material rather than on argument, which matters because attack blogs are built almost entirely out of material they took from you.
- A site that keeps breaching the rules puts its own hosting account at risk, which is pressure no letter about fairness will ever create.
- Anonymous attack sites are routinely registered with false details, and that carries consequences of its own.
WordPress.com or self-hosted WordPress?
They share a name and nothing else that matters here.
WordPress.com is a hosting service run by Automattic. Sites usually end in wordpress.com unless a custom domain has been attached. Automattic operates a user guidelines and abuse reporting process, publishes transparency reports, and acts as a DMCA agent for copyright complaints. There is a company to write to and a process that produces answers.
Self-hosted WordPress is free open-source software installed on any hosting account with any domain. There is no central authority behind it. Automattic cannot remove a self-hosted site and does not try, so the pressure has to come from the companies that keep the site online and from the search results that make it findable.
The technical record settles which of the two you are dealing with, and that check is the first thing we do, because everything else depends on it.
Automattic’s position on abuse and defamation
Automattic acts on clear breaches of its own guidelines, which cover threats, targeted harassment, doxxing, impersonation, non-consensual intimate imagery, malware and phishing. Those rules are enforced on evidence, and they are enforced reasonably quickly.
Defamation is different, and it is worth being blunt about it. As a United States company, Automattic is not liable for what its users publish, and its stated position is that it does not adjudicate whether a claim is true. A long letter explaining that the blog about you is unfair produces a polite reply and no removal. This is the single most expensive misunderstanding in this category, and it is where most people start.
What actually moves an attack blog
Attack blogs are lazy. They lift your photographs, your headshots, your logo, your sales pages, your course slides, your video stills and sometimes entire articles you wrote, because that material is what makes the blog look substantial. It is also yours, and that is the fact the operator did not think about.
That is the shape of the work. We establish what the site runs on and who keeps it online, we find every ground that applies rather than the one that is obvious, and we pursue them together rather than one at a time, in an order that does not tell the operator what is coming. A blog stripped of the material it took is a much weaker page, and it often stops ranking on its own. The site, the mirrors, the caches and the search results are all checked afterwards, so what you get is verified, evidenced to you and monitored rather than a claim that something has been dealt with.
Timelines depend on the route and on the companies involved, and they are set out in writing after the free Exposure Scan. Our website takedown and remove an attack website pages cover the wider version of this work, including the sites built specifically to extort.
Get a Free, Confidential Exposure Scan
Mirrors on Blogger, Medium and elsewhere
Assume the blog is not the only copy. Whoever built it usually publishes the same posts on Blogger, on Medium, on a Substack, on a free site builder, and sometimes on a second WordPress.com account created the same day. Each platform has its own reporting process, and each copy ranks independently.
Removing one and leaving four is the most common way this work fails. Every copy is found before anything happens, and they are dealt with inside the same window, so the operator cannot simply promote whichever mirror survived. An anonymised account of one such campaign against an educator is at our trading educator case study.
What we will not do
We will not pay an operator to take a site down. Paying confirms the model, funds the next site, and buys nothing verifiable, because an unpublished page can be republished the same evening. Where a site is built purely to extract payment, there are other answers, including law enforcement and your counsel where the conduct crosses into extortion. That is a slower path and a permanent one.
What the law and the host’s rules say
Three different rulebooks apply, and the site’s setup decides which of them are open to you.
Platform and host rules come first. On WordPress.com those are Automattic’s own user guidelines, enforced as rules and on evidence. On a self-hosted site the equivalent is whatever the hosting company promised its customers it would not tolerate, which is usually more than the operator realises.
Copyright is the second rulebook and the most reliable, because it works on material rather than on argument. Under section 512 of the US Copyright Act there is a real process behind it, and equivalents exist elsewhere.
Defamation law is the third, and it is the weakest lever against an American host. Section 230 of the Communications Decency Act keeps the host out of liability, so the argument has to be had with somebody else. That is not the same as there being nothing to be done, and it is the point at which most people conclude wrongly that they are stuck.
What we need from you to start
The scan runs on public information, including the technical record, so the diagnosis costs you nothing. The work itself needs a proper file.
- Every URL on the site that concerns you, plus every mirror you have already found on Blogger, Medium, Substack or a second WordPress account.
- Originals of everything the site copied: photographs, headshots, logo files, sales pages, slides, video, articles you wrote, with dates and proof of authorship.
- The records that disprove any specific factual claim: court or regulator records, contracts, refund ledgers, employment records, dated correspondence.
- Any contact from the operator, particularly anything demanding payment, preserved exactly as received rather than deleted.
- Details of any legal correspondence already sent by anyone, so we do not cut across your counsel.
- Written authorization naming who instructs us, usually the person the site is about, their lawyer or their agency.
NDA is standard, and evidence is captured and archived before any complaint is filed.
Timelines and what usually happens first
The first work is the technical record and a full capture of the site and its mirrors. Moving before that is how an operator learns you are watching and shifts the content somewhere harder to reach.
After that, timelines depend on the route and on the companies involved, and you get ranges in writing item by item rather than a single date. Offshore hosts with no working abuse process are the slow case, and we say so when that is what we are looking at. Hosts, registrars, search engines and courts decide their own outcomes, and we do not promise them.
Common mistakes that make it harder
- Filing one notice and waiting. The mirrors carry on ranking while you wait, and the operator promotes whichever copy survived.
- Paying the operator. It funds the next site, confirms the model works, and buys nothing verifiable, because an unpublished page can be republished the same evening.
- Emailing the operator to ask them to stop. It confirms the site is hurting you, and your message usually appears on the site the next morning.
- Sending a defamation letter to a US host. It produces a polite reply and no removal, and it can be published.
- Deleting your own material. People take down the original photograph or sales page that would have proved the site copied them.
- Failing to capture evidence first. Sites disappear and reappear, and a case built on memory is not a case.
- Chasing the domain when search was the real problem. A site nobody finds has already stopped costing you money.
How this works alongside your lawyer, PR team or security team
We handle the removal work and we do not replace anybody advising you.
Where you have counsel, we file the copyright, host, registrar and search routes and hand them a documented evidence file if identification and litigation become worthwhile, and we plan the sequence with them so nothing we file cuts across a claim or a letter they intend to send. Where a story is forming, your communications people decide what is said in public and we tell them what is realistically going to come down and when. Where an attack site publishes home addresses, travel patterns or family details, your security team should see it immediately, because that is a physical risk question before it is a search question. Where the site is being used to extract payment, extortion is a matter for counsel and law enforcement and we support both. All of it runs under NDA and the report is yours to keep.
Who usually makes first contact and what the 15-minute call covers
First contact is usually the person the site is about, their lawyer, or their agency, and it often comes the week a client, a bank or a journalist mentions the site.
Fifteen minutes covers what the site runs on, what it has copied, which routes are open, and whether a scan is the right next step. Nothing is signed on the call. If the site is one page of opinion on a free host and a single copyright notice would strip it, we will tell you that rather than proposing a project.
Frequently asked questions
Will Automattic remove a blog that is lying about me?
Not on the basis of the claim being false. As a United States company it does not adjudicate truth, and it generally wants a court order before removing content on defamation grounds. That is not the end of the road, but it does mean the productive argument is a different one from the one most people arrive with.
The blog is anonymous. Can it still be dealt with?
Yes. Most of what works against a site like this does not depend on knowing who built it. Identification only becomes necessary if you intend to sue, and that is a decision for counsel after the content is down.
It is on a custom domain. Does that change things?
It tells you the site may be self-hosted, or a WordPress.com site with a domain attached, and the technical record settles which. A custom domain also brings another company into the picture, which is usually good news rather than bad.
How long does a site like this take to remove?
It depends on the host’s jurisdiction and on how much of the site is material taken from you, which is why an honest answer only exists after someone has looked. You get a range per item in writing after the scan rather than a promise on a call.
Can the attack blog just come back on a new domain?
It can, and operators do. Clients on a Protection Plan have their name monitored so a new site is caught within days of being indexed, which is when it is cheapest to remove.
Who contacts you about this, and what does it cost?
Usually the person the blog is about, their lawyer, or their agency. The 15-minute call is short and confidential, NDA is standard, and pricing is quoted in writing after the free Exposure Scan, mostly tied to content actually coming down: see success-based pricing.
Can you find out who is behind the site?
Sometimes, from the technical record, the payment trail and the writing itself, and we are careful about what we assert rather than infer. Removal does not require it. Identification matters only if you intend to sue or to go to the police, and that is a decision for your counsel after the content is down.
The site is ranking above my own website for my name. What moves first?
Usually search, because that is the part costing you money today, and a site nobody finds has already stopped mattering. See remove search results. The takedown work runs alongside it rather than afterwards.
If someone has built a site about you, the first step is establishing what it runs on and what it copied. Get a free, confidential exposure scan: we map the site, its mirrors and its stack, tell you what is removable and on what ground, and show you our process before you commit.
