The online regulator has given sites until March 31 to publish risk assessments setting out how users could encounter harm on their sites.