Social Media Crisis Plan: Steps, Template + Examples
Write a short playbook before you need it: monitoring triggers, a respond-hold-remove-ignore table, roles, approvals, first-hour steps and a fill-in template.
Written & reviewed byAnthony Will, Founder & CEOReputation Resolutions · 13+ year industry veteranUpdated November 2026 · 10 min readKey takeaways
- A social media crisis plan is a short written playbook: what counts as a crisis, who monitors, who approves, and what to do in the first hour. Write it before you need it and name a backup for every role.
- Decide your triggers against a normal week of mentions, then use a decision table to choose among four moves: respond, hold, remove (report) or ignore. Do not delete or debate by reflex.
- In the first hour, capture evidence, open one shared channel, pause scheduled posts, check whether the claim is true, secure accounts and say only what is approved. The hour is a target for your plan, not a promise.
- Moderate comments with a published policy applied to everyone, never buy fake followers or praise to drown out criticism, and finish every incident with an after-action review that updates the plan.
In this guide
A social media crisis plan is a short written playbook that names who watches your accounts, what counts as a crisis, who approves a public reply, and what to do in the first hour. Write it before you need it, keep it to a few pages, give every role a backup, and rehearse it yearly.
A bad day is not a crisis. A crisis is when attention, speed or severity outruns your normal routine: a post of yours quoted by thousands, a pile-on from accounts you do not recognize, or a claim that could hurt customers or staff. If one is live and you want a team to handle the response, our social media crisis management page explains what we do. This guide is the do-it-yourself version, and it works whether or not you ever call anyone.
It covers triggers, roles, the first hour, a decision table for respond, hold, remove and ignore, moderation and the review you hold afterward. We are not a law firm and nothing here is legal advice. Anything with legal exposure, such as an admission, a claim about a person or a privacy matter, should be checked by your counsel first.
What counts as a social media crisis
A social media backlash is a surge of public criticism that spreads faster than you can answer it one message at a time. It becomes a crisis when it threatens trust, safety, revenue or legal standing, or keeps growing after you respond. Deciding the level in advance keeps you from overreacting to a small flare-up or underreacting to a real one.
Level 1: Watch
- What it looks like
- A few negative posts or comments, little spread, no press interest
- Default owner
- Account owner, with the incident lead informed
Level 2: Active
- What it looks like
- Criticism gaining traction, a post of yours being quoted, a creator or reporter noticing
- Default owner
- Incident lead, with the approver and writer in the loop
Level 3: Crisis
- What it looks like
- Sustained spread, a coordinated pile-on, a safety, legal or privacy claim, impersonation, or a compromised account
- Default owner
- Incident lead and approver, with counsel from the start
These levels are examples. Adapt them to your own history.
Monitoring triggers to write down
Decide in advance what makes someone sound the alarm. Look at a normal week of mentions, replies and comments, write the numbers down, and set your triggers against that baseline. A starting list:
- Volume. Mentions, replies or comments well above your normal week, using a number you chose in advance.
- Reach. One of your posts quoted, stitched or screenshotted by accounts with large audiences.
- Press or creator contact. A reporter, creator or industry account asks about the issue.
- New accounts. A cluster of new or empty accounts posting the same wording or tagging you at the same time, which can point to coordination.
- Safety, legal or privacy claims. Any post alleging harm, discrimination or a data problem, or naming an employee.
- Impersonation or compromise. A fake account using your name or logo, or unexpected posts on your real accounts.
- Review spikes. A sudden run of one-star reviews, which can follow a social post. Our guide to review bombing covers that case.
Set up notifications and saved searches for your brand, products, leaders' names, misspellings and handles, and assign a named person to check them.
Roles and approvals
Social media crisis communication works when everyone knows their job before the incident starts. Six roles cover most organizations, and in a small one a single person may hold several, as long as each has a backup.
Incident lead
- Responsibility
- Declares the level, runs the checklist, keeps the log
- Fill in
- Name and backup
Approver
- Responsibility
- Signs off every public statement; usually the head of the organization or a delegate
- Fill in
- Name and backup
Writer
- Responsibility
- Drafts statements and replies in plain language
- Fill in
- Name and backup
Account owner
- Responsibility
- Posts, pauses scheduled content and applies moderation rules; holds the logins
- Fill in
- Name and backup
Legal or compliance reviewer
- Responsibility
- Checks lines with legal, privacy or regulatory exposure
- Fill in
- Your counsel and a second contact
Support lead
- Responsibility
- Briefs front-line staff and handles direct messages
- Fill in
- Name and backup
Keep the approval chain short: the writer drafts, the legal reviewer checks only the flagged lines, and the approver signs off. Name who approves when the head of the organization is unreachable. A plan that needs three sign-offs will be skipped under pressure.
Keep pre-approved replies for common situations so the writer does not start from a blank page. Our holding statement examples give you wording to adapt. For the organization-wide documents, see our crisis communication plan and crisis management plan pages.
What to do in the first hour
This is the checklist your plan should hold. The hour is a target for your plan, not a promise from us. The order matters more than the clock.
Step 1: Capture the facts. Screenshot the posts with their URLs, times and account names, and note who posted first and where. Do not reply yet.
Step 2: Open one shared channel. The incident lead brings the approver, writer, account owner and legal reviewer into one thread so everyone works from the same facts.
Step 3: Pause scheduled content and ads. A cheerful scheduled post mid-incident reads as tone-deaf.
Step 4: Check whether the claim is true. Ask the people who know. If you cannot confirm it yet, you are in the hold lane below.
Step 5: Pick the level and the move. Use the tables in this guide and record who decided.
Step 6: Secure the accounts if compromise or impersonation is possible. Change passwords, confirm two-step verification, remove admins you do not recognize, and report any fake accounts through the platform.
Step 7: Brief front-line staff. Give them a short paragraph on what is known and who handles questions, and ask them not to post personally.
Step 8: Say only what is approved, and when you will update. Post the approved message, name an update time only if you can meet it, and log what was said and when.
Response decision table: respond, hold, remove or ignore
The table gives a default move for common situations.
A real customer or follower raises a fair complaint
- Default move
- Respond
- Why
- A calm public reply is read by everyone watching, not just the complainer
- Watch for
- Move details to a private message and do not argue
A false claim is spreading about you
- Default move
- Respond
- Why
- A short, factual correction from one official place, with a link to the source, is easy to share
- Watch for
- Do not repeat the claim or attack the person
The facts are unclear or an investigation is under way
- Default move
- Hold
- Why
- A brief acknowledgment that you are looking into it, with a time for the next update, beats silence or a guess
- Watch for
- Only promise an update you can deliver
A coordinated pile-on from new or empty accounts, or copied wording
- Default move
- Remove (report) and do not engage
- Why
- Many platforms have rules against coordinated or fake activity, so check the current policy; a documented pattern is easier to report than single posts
- Watch for
- Capture evidence first and do not feed the thread
Threats, doxxing, hate speech or impersonation
- Default move
- Remove (report) and escalate
- Why
- These generally break platform rules, and threats of violence may need the police
- Watch for
- Preserve evidence before it comes down; safety comes first
One troll or a single off-topic jab
- Default move
- Ignore
- Why
- A reply gives it more reach
- Watch for
- Watch whether others start repeating it
A trend or hashtag that mentions you in passing
- Default move
- Ignore and monitor
- Why
- Joining may pull you into a conversation that is not about you
- Watch for
- Reassess if it picks up
A reporter or creator asks about the issue
- Default move
- Hold
- Why
- Route to the named spokesperson and reply once approved
- Watch for
- Note any deadline and do not improvise
An employee's personal post is causing the issue
- Default move
- Hold
- Why
- Handle it internally first, then decide the public step with HR and counsel
- Watch for
- Do not publicly name or shame the person
Deleting your own post has consequences too. Screenshots usually exist already, so a quiet deletion can look like a cover-up. If a post is wrong, a clear correction is often better than making it vanish. That is our judgment, and counsel should weigh in where legal exposure exists.
Comment moderation rules
Publish a short comment policy and apply it the same way to everyone. Say what you remove, such as spam, threats, hate speech, personal information and repeated copies, and what you leave up: civil criticism, including criticism of you. Applying rules only against critics looks like censorship.
Meta's help page says Facebook Page admins can block up to 1,000 keywords, that comments containing a blocked word are hidden from the Page, that the setting applies only to content the Page created, and that you can unhide a comment later. YouTube's comment settings include holding comments for review, blocked words and links, pausing comments and hiding specific users. YouTube notes that held comments are kept for up to 60 days and that its AI-based levels may not always be correct.
Filters make mistakes, so review what they hold. Screenshot anything before you hide or delete it.
Platform notes you can adapt
Each platform has its own tools and rules, and they change. Check each help center when you write the plan and again each year.
| Platform type | What to look up in advance |
|---|---|
| Short-post sites | Who can reply or quote, muting and blocking tools, blocked words, and the report form for impersonation and coordinated activity |
| Video and photo platforms | Comment hold settings, blocked words and links, pausing comments, limiting accounts, and how re-uploads are reported |
| Forums and thread sites | Moderators are usually volunteers, not you; read the rules before posting |
| Review sites | Reporting channels differ; see our guide to review bombing |
Do not drown out criticism with purchased followers or praise. The FTC's question-and-answer page on its fake reviews rule says the rule covers purchasing fake indicators of social media influence, such as bot followers. If posts violate a platform's rules, our negative social media removal and Reddit thread removal pages explain what can be reported.
Two worked examples (hypothetical)
Invented scenarios, not client results.
A viral customer video. A customer posts a video saying a regional cafe ignored a food allergy complaint, and it is shared widely overnight. The account owner flags Level 2 and the incident lead opens the shared channel. The cafe cannot yet confirm the facts, so the move is hold: a short acknowledgment with a time for the next update, and scheduled posts pause. Once the owner has spoken to staff, the approver signs off on a factual reply. Counsel checks the wording because it touches a health claim.
A coordinated pile-on. After a false rumor about a software company's pricing, hundreds of new accounts tag it with the same copied sentence. The new-accounts trigger fires and the level goes to 3. The incident lead captures evidence, reports the cluster under each platform's rules and adds the copied sentence to the keyword filters. The company posts one factual correction and does not reply to the accounts, while real customers with real questions still get answers.
A fill-in plan template
Copy the table into a document, fill in each row and keep a printed copy.
| Section | Fill in |
|---|---|
| Purpose and scope | Which accounts, brands and locations the plan covers |
| Levels | Your three levels, each with an example from your own history |
| Monitoring | Tools, search terms, who checks and how often |
| Roles and backups | Names, phone numbers and an after-hours contact for each role |
| Approval path | Who signs what, and who signs when the approver is unavailable |
| First-hour checklist | Your version of the eight steps above |
| Decision table | Your adaptation of respond, hold, remove and ignore |
| Pre-approved replies | Fair complaint, false rumor and a we-are-looking-into-it message |
| Moderation and security | What you remove, what you leave, who holds logins, and two-step verification |
| Contacts | Counsel, platform support routes, and any outside vendor |
| After-action review | Date, owner and the questions you will ask |
After-action review
When the incident has calmed, hold a review while memories are fresh. Ask five questions: what triggered it, when did we notice, how long did decisions take, what worked, and what do we change. Update the plan, the pre-approved replies and the trigger numbers.
A social crisis can linger in search results and AI answers, and our guide on how to recover from a PR crisis covers that stage.
When to bring in outside help
Call your own counsel first if there is a legal, safety or privacy dimension. Outside help makes sense when an attack looks coordinated, when impersonation is involved, or when posts have spilled into search results. For help with statements and messaging, see our crisis communications page.
We work on removal of content that violates platform policy, and removal is 100 percent results-based: you pay only after removal is confirmed, and only content that qualifies is eligible. Response planning and search cleanup are scoped in writing first. We have worked in online reputation since 2013, are A+ accredited with the BBB and are a Google Partner. No one can promise a platform's decision or a timeline, and honest criticism from real customers is generally not removable.
Frequently asked questions
What is a social media crisis plan?+
A social media crisis plan is a short written playbook that says what counts as a crisis, who monitors your accounts, who approves public replies, and what to do in the first hour. It also holds pre-approved replies, a comment moderation policy and an after-action review. Write it before an incident, keep it to a few pages and give every role a named backup.
What should a social media crisis plan include?+
At minimum: severity levels, monitoring triggers, roles with backups, an approval path, a first-hour checklist, a decision table for respond, hold, remove and ignore, pre-approved replies, a moderation policy, account security steps, key contacts and an after-action review. The fill-in template in this guide lists each section.
How do I respond to a social media backlash?+
Check whether the claim is true, pick the level and then pick a move. Respond to fair complaints and false claims with a calm, factual reply from one official place. Hold with a short acknowledgment if the facts are unclear. Report coordinated or abusive activity that breaks platform rules, and ignore isolated trolls. Whatever you say should be approved first, and anything with legal exposure should be checked by counsel.
Should I delete negative comments?+
Delete or hide only content that your published moderation policy says you remove, such as spam, threats, hate speech and personal information, and screenshot it first. Civil criticism generally stays. Removing critics' comments while leaving praise can look like censorship and may make the story bigger.
What should I do in the first hour of a social media crisis?+
Capture the posts with URLs and times, open one shared channel with your named roles, pause scheduled posts, check whether the claim is true, choose the level and the move, secure accounts if compromise is possible, brief front-line staff, and post only what is approved with a time for the next update. The hour is a target for your own plan, not a guarantee, and a real incident may take longer.
Who should approve a public response?+
One named approver, usually the head of the organization or a delegate, with a backup for when they are unreachable. A legal or compliance reviewer should check lines that involve admissions, claims about people or privacy. Keep the chain short, because a plan that needs many sign-offs tends to be ignored under pressure.
How often should I update the plan?+
At least once a year, and after every incident through the after-action review. Also update it when platforms change their tools, when staff or accounts change, and when your approver or legal contact changes. Rehearse it once a year with a made-up scenario so people know their roles.
Can you get posts removed during a social media crisis?+
Posts can be removed when they violate the platform's rules, for example threats, doxxing, impersonation or coordinated fake activity. Honest criticism from real people generally cannot. Our removal work is 100 percent results-based, so you pay only after removal is confirmed, and only content that qualifies is eligible. No one can promise a platform's decision or a timeline.
Sources & references
Prefer we handle it?
Something spreading about you right now?
Tell us what is happening and where. We look at what can be reported under platform policy, tell you what cannot, and scope any response work in writing. Removal is paid only after it is confirmed.
See social media crisis managementReady to See What AI Finds About Your Reputation?
Schedule your free, confidential consultation and we'll show you exactly where you stand across search engines, review sites, and AI platforms.