Someone copied my website: what to do now

Save the evidence today, before it moves

This is the step people skip, and it is the one that costs them. A copycat who senses they have been noticed edits the pages, hides the store behind a password, or moves the whole thing to a fresh domain. Then you are standing in front of a takedown form describing something that no longer exists. Do this part first, in one sitting, before you contact anybody.

• Archive the pages with a third party. The Internet Archive's Save Page Now creates a dated public snapshot at a permanent URL. A capture held by a neutral party is worth far more than a file on your laptop, because you did not make it and you cannot edit it.
• Screenshot every page you will name. Full page, with the URL bar and the date visible in frame. One per infringing page, not one of the homepage. Every takedown form asks you to point at specific pages, and a screenshot of a page you cannot link to proves nothing.
• Save the page source. Copycats are lazy. The HTML often still references your CDN, your image filenames, or your brand name in an alt tag or a leftover paragraph. That is the single most persuasive thing you can put in front of a host reviewer. While you are in there, check what theme the copycat store is running and note it with the rest. Then compare the two stores side by side and keep the record, which gives you a dated page you can hand to a reviewer.
• Record the domain details at the moment of discovery. The registrar, the nameservers and the IP address it resolves to. All of these change once a report lands, and you want to be able to show what they were on the day you found it.
• Gather proof that your version came first. The original camera files with their embedded dates, your Shopify admin showing when each product was created, older archived captures of your own site, and any invoice from the photographer or designer. Every notice you send rests on you owning the work, so have that ready before anyone asks.
• Write down the prices and the claims. If the clone is selling at 20 percent of your price, or repeating your guarantees and your reviews, note it. It matters to a host deciding how fast to act, and to a payment processor deciding whether the store is a fraud risk.

Do not email the copycat before this is done. It feels like the natural first move and it is the one that most often destroys the case. Once your evidence is safe, a direct message is a perfectly reasonable thing to try, and small copycats do sometimes fold the moment a real brand contacts them.

What has to be in the notice

A DMCA notice is not a complaint letter. US law sets out what a notice has to contain before a provider is obliged to treat it as one, and a notice missing a piece can simply be set aside. Whether you write it yourself or fill in a host's form, the same six things have to be there.

• Your signature, physical or electronic, as the owner or as somebody authorized to act for the owner.
• Identification of your work. Which photos, which product descriptions, which pages. Link to your originals.
• Identification of the copies, precisely enough to find them. Page-level URLs. Not the store's front page, not a domain, the actual pages.
• Your contact details. Name, address, phone, email. Expect these to be passed to the person you are reporting, because most providers forward the notice.
• A good faith statement that the use is not authorized by you, your agent or the law.
• A statement under penalty of perjury that your information is accurate and that you are authorized to act for the owner.

Take that last line at face value. It is why you claim only what is genuinely yours. Stock imagery you both licensed is not yours. A product shape or an idea is not a copyright claim. Sending a sloppy notice invites a counter-notice, and it hands the copycat something to point at.

Everything above is assembly work: gathering links, matching originals to copies, writing the same paragraph again for the fourth page. It is the reason people give up halfway. If you would rather not do it by hand, this is exactly what a service that builds the notice and the evidence for you is for.

Cloudflare and the other layers in the middle

If the domain resolves to Cloudflare, you have not found the host. Cloudflare sits in front of the real server as a proxy, so it usually cannot remove content it does not store. What it does do is take your report through its DMCA abuse form, forward it to the site operator and the origin host, and give you the hosting provider's details so you can go to them directly. Treat it as a lookup that also delivers your notice, and expect to file again one layer down.

There are usually two more doors worth knocking on. The registrar's abuse contact is the right one when the whole domain exists to impersonate you, rather than one page being copied. And if the clone is taking payments, the payment provider cares a great deal about a store collecting card details for goods it never ships. Say plainly that customers have paid and received nothing, if that is what is happening.

When the clone has a real operator behind it, with a name and an address, the last door is the operator. That is the point to generate a cease and desist letter and put them on dated notice.

When the clones keep coming back

Everything above handles one site. The hard part is what happens next. Operators who clone a store rarely clone it once. A domain costs less than lunch, the scrape is automated, and the same photos go back up on a new address inside a week. Founders describe this as digging a hole in the sand, and the accurate part of that is the arithmetic: the copying is nearly free, the reporting is nearly all manual, and it is all yours.

Two things change the arithmetic. The first is knowing early. Almost nobody finds a clone themselves. It arrives as a customer message, months late, after the refunds and the one-star reviews have already attached to your name. The second is not rebuilding the case each time. When the same photos come back on a new domain, most of the package you already sent still applies, and the only genuinely new work is the new URLs and a fresh capture.

That is the shape of what Knockoff does. Connect your Shopify store and your catalog becomes the reference: your product photos get watched across marketplaces and the open web, and copycat storefronts running your images get surfaced without you searching for them. Each one arrives as a finished case with an archived copy of the page, a timestamped screenshot, your original beside theirs, and the notice already written and routed to the right form. You approve it, a real person at Knockoff reads the notice, and you file it yourself in one click through the provider's own form. If the store reappears on a new domain, the follow-up package opens without you starting over. See how that runs from a connected store to a filed takedown, or the wider picture in keeping watch on every surface your photos can turn up on.

The honest limits, because you should know them before you pay anyone for this. Knockoff works with Shopify stores only. It prepares filings and you submit them; it never files anything for you and nobody at Knockoff is a lawyer. And no vendor in this category controls what a host, a registrar or a platform decides to take down, so treat any promise of removals as a sales line. Plans and what each one covers are on the pricing page.