What access does an SEO company need to my accounts?
Short answer
An SEO company needs its own user access to your website, your Google Business Profile, Google Search Console and Google Analytics, plus Google Ads if it manages your ads. It doesn't need your passwords or ownership of any account. You stay the owner, invite them as a user, and remove them when the work ends.
An SEO company needs its own user access to your website, your Google Business Profile, Google Search Console and Google Analytics, and it doesn’t need your passwords or ownership of any of them. Each of those products lets an owner invite another person under that person’s own login, with a role that limits what they can do. You stay the owner. The company is a guest whose access you can remove on any day.
Which accounts, and why
Access should match the work. A company will normally ask for the following.
| Account | What it’s used for | What to grant |
|---|---|---|
| Website (WordPress or another content system) | Editing pages, titles and structured data, and fixing technical problems | A separate user account for the company, at the level the work needs |
| Google Business Profile | Categories, services, photos, posts, and review replies if you want that handled | Manager, with you remaining the primary owner |
| Google Search Console | Seeing which searches show your pages and whether Google can read them | A user added to your property |
| Google Analytics | Seeing what visitors do once they arrive | A user role on your property |
| Google Ads (only if they manage your ads) | Building and adjusting campaigns | Access to your own account, by invitation |
| Domain registrar and hosting | Occasional technical jobs, such as a site move or a verification record | Usually none. Make the change yourself with guidance, or grant access for the job and then remove it |
Role names and permission levels in Google’s products change from time to time, so check the current options on the users or access screen of each product when you send the invitation.
What they shouldn’t need
Your own login is yours alone, and the work can be done without it. A shared password can’t be limited or traced to one person, and changing it later locks out everyone at once. Ownership is the same: the company can work without it. If a company says it must create the Google Business Profile, the analytics property or the advertising account under its own name, ask why. Sometimes there’s a practical reason, but the usual result is that the account and its history stay with them if you leave. It comes down to who owns your website and accounts if you leave your agency.
Payment details are separate too. Nobody needs your card number to do SEO. For advertising, where the billing should sit is part of who should own the Google Ads account.
How much access an audit needs
Less than ongoing work. An audit is mostly reading: I can measure rankings from outside and crawl a site without logging in. View access to Search Console and Analytics adds what an outsider can’t see. So what you need to provide for an SEO audit is a shorter list than the table above, and that holds for a Scientific SEO Audit too.
Good habits for granting and removing access
Treat it like handing out keys to the shop.
- Invite a named person or a company address you can identify later, not a generic one.
- Give the lowest role that lets the work get done, and raise it when a task needs it.
- Keep a short list of who has access to what, and review it once or twice a year.
- Remove access the day the work ends. Do the same for past vendors and former employees.
- Turn on two-step verification for the owner login, since every other permission hangs from it.
My own position is plain: you own the website, the domain, the Google Business Profile and the accounts, and I work inside them as a user you invited.