How to capture a web page as evidence before it changes

Why isn't a screenshot enough to prove what a website said?

Because a screenshot is an image that can be altered, and the page can be altered before the screenshot is even taken: a browser's developer tools let anyone change the text on screen in seconds without touching the real site.

On top of that, an ordinary screenshot shows only the visible part of the page, the file's date changes when it is copied, and the address bar, if it appears at all, is as editable as everything else. If the other side denies publishing the content, a lone image leaves you little to answer with.

What does a solid web page capture contain?

Several pieces that back each other up, so that changing one without it showing is hard:

• A full-page image, top to bottom, not just what fits on the screen.
• The HTML source as the server delivered it. It holds the text, links and data the image does not show.
• The HTTP response headers: the technical data the server sends along with the page, such as the date according to the server itself and the content type.
• The exact URL, with all its parameters, and the capture time with its time zone.
• A SHA-256 hash of each file, so any later change can be detected.
• A third-party timestamp over those hashes, so the date does not rest on your word or your computer's clock.

How do you save a web page manually, step by step?

A browser and the tools already on your operating system are enough:

1. Copy the full URL from the address bar into a notes file.
2. Write down the date, the time and your time zone.
3. Save the page with "Save as" and pick the complete page format. As a readable backup, also use "Print" and "Save as PDF".
4. Take a full-page screenshot. Several browsers offer one in their menu or developer tools.
5. Open the developer tools, go to the network tab, reload the page and copy the response headers of the main document into a text file.
6. Compute the SHA-256 hash of each file: on Linux, sha256sum file; on macOS, shasum -a 256 file; on Windows, certutil -hashfile file SHA256.
7. Keep the hashes in a list and do not modify the files again.

The weak spot of the manual method is the date. You computed the hashes yourself, on your own machine, and nobody else can confirm when. Closing that gap takes a third party that timestamps the hashes. You can timestamp each file with Certify file, and the mechanics are explained in what a trusted timestamp is.

The shortcut is Certify website. You enter the URL and a browser running on a server, not yours, visits the page, saves the screenshot, the HTML and the headers, and issues a certificate with the hashes and the timestamp. Having a machine that is not yours make the visit removes the objection that you changed the page on your own screen. Download the files as soon as it finishes and store them yourself.

Does the Wayback Machine work as proof of what a page said?

Yes, as a complementary, independent record. The Internet Archive's Wayback Machine lets you request that a copy of a public page be saved, and the copy becomes available at an address that includes the capture date. Its value is that the copy is held by an organization with no connection to your dispute.

It has limits worth knowing before you rely on it alone:

• Not every page can be saved. Some sites block archivers or ask for their content to be excluded.
• It cannot reach pages that require a login.
• Pages assembled mostly by code running in the browser may be saved incomplete.
• A copy may stop being available later.

The sensible approach is to do both: your own capture with a hash and a timestamp, plus a copy in a public archive.

What are the limits of any web page capture?

There are three, and they apply to every method:

• Public pages only. An automated capture sees what any visitor without an account would see. Private messages, closed groups and internal dashboards are out of reach.
• Personalized content. Many sites show different things depending on country, device, cookies or time of day. Two people can see different versions of the same address.
• Pages that change. A capture reflects one instant. If the content changes every few minutes, record several moments.

If what you need to show is only visible while you are signed in, save what you can by hand and ask a lawyer whether a notarized record or a forensic examination is appropriate. On social networks, also copy the direct link to the post, not just the profile link.

What does a captured page prove, and what doesn't it prove?

It shows that, on the timestamp date, that address returned that content to whoever visited it, and that the files have not been modified since. Anyone can confirm this by checking the hash on the verification page.

It does not show who wrote or published the content, how long it stayed online, how many people saw it, or whether what it says is true. Courts generally look at integrity, date, origin and context, and decide admissibility and weight under their own country's rules. A certificate does not guarantee legal value and does not replace a notary or a digital forensics expert. In serious matters, or when you expect the other side to deny everything, bring one of them in.

Checklist and common mistakes

1. Capture as soon as you see the content, before you complain to or warn whoever published it.
2. Record the exact URL and the time with its time zone.
3. Collect the full-page image, the HTML and the headers.
4. Hash each file and get a trusted timestamp.
5. Request a copy in a public web archive as well.
6. Keep the originals in two places and do not edit them.

The most common mistakes:

• Cropping or annotating the original image. If you need to highlight something, do it on a copy.
• Saving only the home page when the content lives on an inner page.
• Using a shortened link or a search engine's link instead of the real address.
• Opening the HTML, saving it again and assuming the earlier hash still applies.
• Trusting that the page will still be there tomorrow.