Should I give an SEO company access to my website?

Yes, because the work you are paying for happens inside your website and your Google accounts. The way to do it is to give the company user accounts of its own, at the lowest level that covers the work, while you keep ownership of everything. You should not need to share your own passwords. Two details matter more than the general rule: the right role in each tool depends on the task, and in Search Console, removing a person at the end of the engagement is not always enough on its own.

What access the work needs

Routine SEO work needs your website’s content management system, Google Analytics, and Search Console. A local business may add its Business Profile, where the company should be added as a manager rather than an owner. Hosting and DNS access are needed only for specific jobs, such as a site move or verifying a domain, and are better granted for that job and removed afterwards.

Ask the company for a written list of each access it needs and what it will do with it. That list becomes your checklist when the work ends.

Your website

Content management systems let you add users with different roles. In WordPress, for example, the roles and capabilities documentation describes an Administrator as “somebody who has access to all the administration features within a single site” and an Editor as “somebody who can publish and manage posts including the posts of other users.” An Editor account covers publishing and editing content.

Some technical work, such as changing templates or plugins, needs more. In that case, create an administrator account for the specific task, under the company’s own name, and remove it or reduce it once the task is done.

Google Analytics

Google Analytics roles are defined by what they can change, so choose the role by the work. Google’s explanation of Analytics roles describes them this way. A Viewer “can see settings and data”, which covers reading reports. A Marketer “can create, edit, and delete audiences, events, and key events”, which covers setting up the tracking of inquiries and sales. An Editor has “full control of settings at the property level” but “can’t manage users.” An Administrator has “full control of Analytics” and “can manage users.”

Keep the Administrator role yourself. Whoever holds it decides who else has access, so it should not belong to the company you are hiring.

Search Console

Add the company as a user and keep the owner role yourself. The detail to know comes at the end. Google’s Search Console permissions documentation explains that when you remove an owner, “their verification tokens are not deleted or revoked. As long as a user’s verification token remains for a property, a deleted owner can re-verify ownership of the property.”

The same page describes a verified owner as someone who used “a token to prove ownership (such as an HTML file uploaded to the website).” If the company verified itself as an owner at any point, removing it from the user list is half the job. The token has to be removed as well, or the company can verify again.

When a tool has no user accounts

Some tools and older systems allow only one login. If a password genuinely has to be shared, share it through a password manager that lets you share an item and withdraw the share later, not by email or text message. Turn on two-factor authentication where the tool allows it, and agree in advance how the company will get the code, since a code sent to your phone will otherwise stop them at every login. For a domain registrar, look for a delegate or account-access feature before you share the main login.

When the work ends

Go through the access list you started with. Remove the company’s user accounts from the website, Analytics, Search Console, and Business Profile. In Search Console, check for and remove any ownership tokens the company placed. Remove any hosting or DNS access granted for single tasks. Change any password that was shared at any point.

It is worth doing a smaller version of this review during the engagement as well, removing accounts for people who have left the company’s team, so the list stays accurate the whole time.