The protocol is called Run, Hide, Fight — and the order is intentional. Running is the first move for a reason. Getting out of the building and away from the threat entirely puts distance between you and danger. If you can safely evacuate, do it. Don’t wait around.
If running isn’t possible — maybe the shooter is between you and the exit — then hiding is the next best option. But not all hiding is equal. Ready.gov makes this clear: find a spot that’s out of the attacker’s view AND puts something solid between you and them. A locked room with a heavy door is much better than ducking behind a curtain. Lock the door, block it with furniture if you can, turn off the lights, close the blinds, stay low, and stay quiet. Stay hidden until you receive an official all-clear from law enforcement — don’t assume the situation is over just because things go quiet.
There’s also a difference between cover and concealment. Concealment hides you — like a curtain or a thin partition — but won’t stop a bullet. Cover hides you AND can stop a bullet — think concrete walls, steel, or engine blocks. Aim for cover when you can.
Fighting back is the last resort. Every source on this is consistent: only attempt to physically confront the shooter if your life is in immediate danger and you have absolutely no other option. If it comes to that, active shooter response guidance says to act as aggressively as possible — the goal is to disrupt or incapacitate, not to be a hero.
One more thing: call or text 9-1-1 when it’s safe to do so. Even a quick text with the shooter’s location can help first responders get there faster. Don’t assume someone else already called.