Give your SEO access without handing over your passwords
The first week of an SEO engagement is mostly logins. The fastest way through it is the one that causes trouble later: emailing your own username and password. Every tool an SEO needs lets you invite a person by email, give them a role, and remove them in one click when the work ends. Here is the role to pick in each one.
On this page
- Why a shared password costs more than it saves
- Google Search Console: a full user is usually enough
- Google Analytics: Analyst for reading, Editor only for setup
- Google Business Profile: Manager, never primary owner
- WordPress: a named account, removed afterward
- Shopify: a collaborator account with a request code
- The day the work ends
- How I can help
Why a shared password costs more than it saves
A shared login is your identity. Anything done under it looks like you did it, two-step verification codes go to your phone at awkward hours, and when the engagement ends the only way to close the door is to change a password that your own staff also use. An invitation ties every action to a named person and ends with a single click. It also keeps the account yours if the relationship sours, which is the case nobody plans for.
Ask your SEO for the Google account or email address they want invited, then use the roles below.
Google Search Console: a full user is usually enough
Search Console has owners and users. In Settings, then Users and permissions, an owner can add a full user, who sees all the data and can take some actions, or a restricted user, who sees most data and can change nothing. A full user covers nearly all audit and indexing work.
Grant owner only when the SEO has to manage other users or settings. Google treats a delegated owner the same as a verified owner except for one thing: a verified owner proved ownership with a token on your site, such as an HTML file or a DNS record. That token outlives the person. Google's help page warns that removing an owner from the property leaves their tokens in place, and while a token remains, that person can verify again and walk back in. When an SEO who verified the property leaves, remove the file or DNS record they added, and only theirs, since one token can also verify Merchant Center or Google Workspace.
A property must always keep at least one verified owner. Make sure that owner is you or someone on your staff.
Google Analytics: Analyst for reading, Editor only for setup
GA4 has five predefined roles, each including the permissions of the one below it:
- Viewer sees settings and data and can build personal explorations.
- Analyst can also share explorations with other users of the property.
- Marketer can also create and change audiences, events, key events, and attribution settings.
- Editor has full control of settings at the property level, without managing users.
- Administrator has full control, including who else gets access.
Analyst covers reporting. Marketer fits an SEO who needs to mark a form submission as a key event. Editor is for someone fixing a broken tracking setup, and Administrator rarely belongs to anyone outside the business. Grant access at the property level unless the SEO works on every property in your account, because account-level access flows down to all of them.
GA4 also offers two data restrictions you can add to any role: No Cost Metrics and No Revenue Metrics. If your SEO has no need to see what you spend on ads or what you earn per order, switch those on.
Google Business Profile: Manager, never primary owner
From Business Profile settings, then People and access, an owner can invite someone as an Owner or a Manager. Google says managers have mostly the same access as owners: they edit business information, reply to reviews, post updates, add photos and products, and download performance data. They cannot add or remove people or delete the profile. That is the right fit for nearly all local SEO work.
The primary owner is the one account that can hand the profile to someone else. Keep it in the business. A primary owner cannot remove themselves until they transfer the role, so a profile whose primary owner is a departed agency is a profile you will spend weeks recovering. Google also applies a seven-day waiting period to every new owner or manager, during which they cannot delete the profile, remove other people, or transfer primary ownership. Plan around that week rather than discovering it on deadline.
The person you invite needs their own Google Account, and Google Groups cannot be added.
WordPress: a named account, removed afterward
WordPress ships with five roles. An Editor manages every post and page, including other people's, but cannot touch plugins, themes, or site settings. An Administrator can do everything, including installing code.
Content work fits Editor. Most SEO plugin settings, redirects, and sitemap options sit behind Administrator, so technical SEO usually needs it. Create a separate administrator account in the SEO's own name and email, never your own login. That keeps their changes traceable in any activity log and lets you delete the account, and reassign its content to you, on the last day.
Shopify: a collaborator account with a request code
Shopify gives outside help its own door. A collaborator account reaches only the sections of the admin you approve, and it does not use up one of your staff seats. Under Settings, then Users and permissions, then Collaborators, you can require a collaborator request code, so only people you have given the code can even ask for access. Shopify's help center says the code requirement is on by default. Generating a new code invalidates the old one, which is a tidy way to stop stray requests after a project.
When the request arrives, approve only what the work needs. Product editing and online store themes cover most SEO tasks. Orders, customers, payments, and finances usually do not belong in the request.
The day the work ends
Access granted this way comes back in a few clicks per tool:
- Remove the person from Search Console, and delete any verification file or DNS record they added.
- Remove them in GA4 at both the account and property level, wherever they appear.
- Remove them from People and access on every Business Profile, and confirm the primary owner is still yours.
- Delete their WordPress account and assign its content to a staff user.
- Remove the Shopify collaborator and generate a new request code.
Keep a short list of every invitation you send during the engagement. Offboarding then becomes reading that list back.
How I can help
I can send you the exact invitations a piece of work needs and the role for each, so the first week goes to the work instead of to logins. If you are staring at a profile or property that a former vendor still controls, book a call or reach me through Upwork.