1. Where did the visit begin?
Keep the full starting URL and say whether you arrived from search, an advertisement, email or a typed address. Different entry points may behave differently. The final destination alone may not tell the whole story.
2. What appeared on screen?
Keep the message or screenshot and note the time. Stop if an unfamiliar page asks for payment, downloads or a login. You do not need to submit private information to reproduce a problem.
3. What device was involved?
Share the device and browser details you have already observed. Remove personal information from customer screenshots. Avoid asking other customers to enter a suspicious page for testing.
4. What changed recently?
List recent updates, plugin installations or setting changes with their dates. These are clues; they do not establish that the most recent change caused the issue.
Useful records make follow-up easier
WordPress also recommends documenting symptoms, discovery time and recent changes. See its official hacked-site guidance.
Send the public URL and your observations for an initial review. Private file or dashboard inspection requires separate authorization.