How to Preserve Website Evidence for Court (2026 Guide)

Website evidence disappears fast. A competitor edits a false claim, a former employee takes down a blog post, or a business quietly changes its terms of service the week a dispute starts. If the page matters to your case, you need a copy that someone can later explain and defend in court, not just a screenshot on your phone.

This guide explains how to preserve a website or web page as evidence: the capture methods, the metadata to record, how hash values prove a copy has not changed, how Federal Rules of Evidence 901, 902(13) and 902(14) apply, and where the Wayback Machine helps and falls short. If you need a documented capture done for you, Honeybadger provides social media evidence preservation and website capture nationwide.

This is general information, not legal advice. Your attorney decides what evidence to offer and how; state courts have their own evidence rules.

Where this guidance comes from. This article is based on the Federal Rules of Evidence (Rules 201, 901 and 902) and the 2017 committee notes to Rules 902(13) and 902(14), the Internet Archive’s own help pages on how the Wayback Machine works, the Library of Congress description of the WARC web archive format, NIST guidance on hash algorithms, and IETF standards for HTTP dates and trusted timestamps. It also reflects how our veteran-led forensics team documents captures so an examiner can explain them under oath.

Why screenshots alone often fall short

Federal Rule of Evidence 901(a) sets a low but real bar: the person offering an item must produce evidence sufficient to support a finding that the item is what they claim it is. For a web page, that usually means showing what address was visited, when, what it displayed and that the copy has not been altered.

A screenshot shows what a screen displayed. On its own it often does not show the full URL, a capture time you can prove, the page source, or anything that rules out editing. Screenshots can still be admitted when a witness with knowledge testifies about them, but they are easy to attack. A documented capture gives that witness a record to stand on.

Screenshots taken by a party also raise a practical problem: the person who took them may have to testify. When the capture is done by a neutral examiner, the examiner can explain the process instead, and in some cases certify it in writing.

Website evidence capture methods compared

No single method fits every case. The right choice depends on how dynamic the page is, whether a login is needed, and how hard the other side is likely to fight authenticity.

Method	What it preserves	Main weakness	Best use
Screenshot by a party	What the screen displayed	No verifiable time, URL history, source code or integrity check	Quick first step before a page disappears
Print to PDF	Rendered page text and layout	Often drops dynamic content; little metadata	Simple static pages, as a supplement
Screen recording	Scrolling, clicks, pop-ups and video	Large files; still needs notes and hashes	Interactive pages, feeds and comment threads
Documented page capture	Rendered page, page source, URL, capture time, headers and hash values	Public content only; attribution still needs support	Most litigation and HR matters
Web archive (WARC) crawl	Requests, responses and resources in a standard archive format	Needs specialist tools to create and replay	Whole sites or many linked pages
Wayback Machine snapshot	A third party’s archived copy at a past date	May be incomplete, blocked or assembled from different dates	Showing what a page said in the past

The Library of Congress lists WARC, the Web ARChive format standardized as ISO 28500, as its preferred format for web archives. Each WARC record has header fields that document the date, type and length of what was harvested, which helps when someone later asks exactly what was collected.

What metadata to record with each capture

Good capture notes answer the questions a judge or opposing expert will ask. For each page, record:

• The full URL, including any query string, and how you reached it (typed, search result or link).
• The date and time of capture, with time zone and the clock source used.
• The HTTP response headers, including the server’s Date header, which RFC 9110 defines as the date and time the message was originated.
• The page source (HTML) as well as the rendered view, plus key images, video and attachments as native files.
• The browser, operating system, capture tool and their versions, and whether you were logged in.
• The name of the person who captured it, and a hash value for every saved file.

Store the originals read-only, work from copies, and keep a simple chain-of-custody log showing every hand the files passed through. Our article on chain of custody in digital evidence explains why gaps in that log cause trouble later.

Hashing: proving the copy has not changed

The 2017 committee note to Rule 902(14) explains hashing in plain terms. A hash value is a number produced by an algorithm from the digital contents of a file. If the hash values of the original and the copy differ, the copy is not identical. If they match, it is highly improbable that the two are different.

Use a current algorithm. NIST announced in December 2022 that SHA-1 should be phased out by December 31, 2030, in favor of the SHA-2 and SHA-3 families. SHA-256, part of SHA-2, is a common choice for evidence work. Record the algorithm with each value so anyone can recompute it.

Hashes prove a file has not changed since you hashed it. They do not prove when it was created. For stronger proof of time, a trusted timestamp under RFC 3161, the IETF Time-Stamp Protocol, lets a timestamping authority attest that a piece of data existed before a particular time.

Need a page captured before it changes? Send us the URLs, how many linked pages matter and any deadline, and we will scope a documented capture with hash values and notes. Request website evidence preservation online, or book a consultation online if you want to talk through the case first.

How courts authenticate website evidence: FRE 901 and 902(13)/(14)

Under Rule 901(b), website evidence is commonly authenticated in one of three ways:

• Testimony of a witness with knowledge (901(b)(1)), such as the person who visited and captured the page.
• Distinctive characteristics (901(b)(4)), meaning the appearance, contents, substance and internal patterns of the page, taken together with all the circumstances.
• Evidence about a process or system (901(b)(9)) that shows the process produces an accurate result, which is where documented capture methods help.

Rules 902(13) and 902(14), added by the 2017 amendments, let some electronic evidence be self-authenticated by a written certification from a qualified person instead of live testimony. Rule 902(13) covers records generated by an electronic process or system that produces an accurate result. Rule 902(14) covers data copied from an electronic device, storage medium or file, authenticated by a process of digital identification such as hash values. Both require the advance written notice described in Rule 902(11), so the other side has a fair chance to challenge the record.

What a certification does not prove

The committee note is direct about the limits. A certification establishes only authenticity. The opponent can still object on hearsay, relevance or other grounds. The note even uses a website example: in a defamation case, a certification describing how a web page was retrieved may authenticate the page, but the defendant remains free to argue the statement was not placed there by the defendant.

That is why capture alone rarely settles attribution. Proving who wrote or posted content may take account records, device evidence or witness testimony. Our guides to authenticating social media evidence and OSINT for litigation evidence cover that side of the problem.

Using the Wayback Machine as website evidence: uses and limits

The Internet Archive’s Wayback Machine is often the only way to show what a page said months or years ago. Its archived URLs embed the capture time as a 14-digit code (year, month, day, hour, minute, second), which helps pin down dates. But the Archive’s own help pages describe important limits, as of October 2026:

• Some sites are never archived because crawlers did not find them, they were password protected, robots.txt blocked them, or the owner asked to be excluded.
• Not every date is complete. When a linked item is missing, the Wayback Machine may pull the closest available date, or even fetch it from the live web.
• Pages that rely on forms, JavaScript or other interaction with the original server lose that functionality in the archive.
• Save Page Now saves a single page one time; it does not capture whole sites or add the page to future crawls.
• The Archive’s help center, updated in May 2026, notes that some publishers and news organizations have begun blocking the Wayback Machine.

The Archive says the Wayback Machine was not designed with legal use in mind, but it receives regular requests for certified records and publishes an affidavit request procedure. Rule 201 also allows judicial notice of facts that can be accurately and readily determined from sources whose accuracy cannot reasonably be questioned, and the Rule 902(13) note says judicial notice remains available where appropriate. Whether a court accepts either for a given archived page varies, so ask counsel early and do not rely on the Archive when you can capture the live page yourself.

How to preserve a web page as evidence, step by step

1. Act now. Pages can be edited or removed at any time. Do not comment, message or otherwise engage with the person who controls the page.
2. List what matters. Write down every URL, including linked pages, images, videos, comments and downloadable files.
3. Capture the live page. Save the rendered page, the page source and the response headers, and record video if the page is interactive.
4. Write capture notes. Record the URL, date, time and time zone, method, tools and versions, and who captured it.
5. Hash every file. Use SHA-256 or another current algorithm, and store the values with the notes.
6. Check the archive. Look for Wayback Machine snapshots that show earlier versions, and note their timestamps.
7. Lock it down. Keep originals read-only, log every transfer, and give counsel copies.
8. Plan for court. Decide with counsel whether you need a witness, a 902(13) or 902(14) certification, or both, and leave time for the notice requirement.

Mistakes that weaken website evidence

• Cropped screenshots. Keep full-screen captures with the address bar and clock visible, and keep the original files, not copies sent through messaging apps.
• Only saving the rendered page. Without page source and headers, it is harder to show what the server actually sent.
• No notes. A file with no record of when, where and how it was captured invites challenges.
• Logging in where you should not. Using someone else’s credentials can be unlawful and can taint the evidence.
• Waiting. The longer you wait, the more likely the page changes or the archive has gaps.

For a deeper look at imaging, verification and custody records, see our explainer on forensic imaging and chain of custody.

How Honeybadger preserves website evidence

Honeybadger Solutions is a veteran-owned firm based in Casa Grande, Arizona, and an Arizona DPS-licensed private investigation agency (License No. 1759795). We capture public web pages and authorized accounts for litigation, HR matters, harassment cases and investigations nationwide.

• Public page and website capture: one starting URL and a set number of linked pages per session, with capture notes for each page covering date and time, URL, method, browser and hash values.
• Authorized account exports, hashed, logged and stored under chain of custody.
• A readable report with native files and hash values, ready for counsel or an expert.
• A written declaration describing the collection and, where it fits, a 902(13) or 902(14) certification signed by the examiner who did the work.
• Deposition or trial testimony about the process through our expert witness testimony service.

We capture only content that is publicly visible or that we are authorized to access, and we never use fake profiles or guessed passwords. Send the URLs and any deadline through the request form, or book a consultation if you want to talk through what to capture first.

Why the online intake is faster than a phone call. The request takes about two minutes. Picking the service routes it straight to the specialist team that handles that type of case, so there is no phone tag and no waiting for a call-back to explain it all again. For anything happening right now, use the urgent intake form.

Frequently asked questions

Are screenshots enough to use a web page in court?

Sometimes, if a witness with knowledge can authenticate them under Rule 901, but they are easy to challenge. A documented capture with the URL, capture time, method, page source and hash values gives a stronger foundation.

What is the best way to preserve website evidence?

Capture the live page as soon as it matters: the rendered page, page source and response headers, with notes on the URL, date, time, tools and who captured it, and a hash value for every file.

Can Wayback Machine pages be used as evidence?

They are often used, but archived pages can be incomplete, assembled from different dates or missing. The Internet Archive publishes an affidavit request procedure, and courts differ on what they require, so plan with counsel.

What do FRE 902(13) and 902(14) do?

They let a qualified person’s written certification authenticate certain electronic records and copied data, such as files verified by hash values, without live testimony, as long as the other side gets advance notice.

Does an authenticated web page prove who posted it?

No. The committee note says a certification establishes only authenticity. The other side can still argue the content was not placed there by them, so attribution may need account, device or witness evidence.

Which hash algorithm should be used for evidence?

Use a current algorithm such as SHA-256. NIST has said SHA-1 should be phased out by December 31, 2030, in favor of the SHA-2 and SHA-3 families.

Related reading

• ▸ Digital Forensics 101: Uncovering Electronic Evidence in Arizona Litigation
• ▸ Is That Video Real? The Rise of Deepfake Forensics
• ▸ Clearing the Noise: Forensic Audio Enhancement
• ▸ Child Custody Investigator in Arizona: Gathering Evidence for Family Court