> Search Console, GA4, Business Profile, WordPress, and Shopify all let you invite an SEO by name. Which role to pick for each, and how to take access back. > > Source: https://christopherabraham.com/guides/give-seo-access/ · Updated 2026-10-28 · By Christopher Abraham # Give your SEO access without handing over your passwords By [Christopher Abraham](https://christopherabraham.com/about/) · Published October 28, 2026 The first week of an SEO engagement is mostly logins. The fastest way through it is the one that causes trouble later: emailing your own username and password. Every tool an SEO needs lets you invite a person by email, give them a role, and remove them in one click when the work ends. Here is the role to pick in each one. ## Why a shared password costs more than it saves A shared login is your identity. Anything done under it looks like you did it, two-step verification codes go to your phone at awkward hours, and when the engagement ends the only way to close the door is to change a password that your own staff also use. An invitation ties every action to a named person and ends with a single click. It also keeps the account yours if the relationship sours, which is the case nobody plans for. Ask your SEO for the Google account or email address they want invited, then use the roles below. ## Google Search Console: a full user is usually enough Search Console has owners and users. In Settings, then Users and permissions, an owner can add a **full user**, who sees all the data and can take some actions, or a **restricted user**, who sees most data and can change nothing. A full user covers nearly all audit and indexing work. Grant **owner** only when the SEO has to manage other users or settings. Google treats a delegated owner the same as a verified owner except for one thing: a verified owner proved ownership with a token on your site, such as an HTML file or a DNS record. That token outlives the person. Google's help page warns that removing an owner from the property leaves their tokens in place, and while a token remains, that person can verify again and walk back in. When an SEO who verified the property leaves, remove the file or DNS record they added, and only theirs, since one token can also verify Merchant Center or Google Workspace. A property must always keep at least one verified owner. Make sure that owner is you or someone on your staff. ## Google Analytics: Analyst for reading, Editor only for setup GA4 has five predefined roles, each including the permissions of the one below it: - **Viewer** sees settings and data and can build personal explorations. - **Analyst** can also share explorations with other users of the property. - **Marketer** can also create and change audiences, events, key events, and attribution settings. - **Editor** has full control of settings at the property level, without managing users. - **Administrator** has full control, including who else gets access. Analyst covers reporting. Marketer fits an SEO who needs to mark a form submission as a key event. Editor is for someone fixing a broken tracking setup, and Administrator rarely belongs to anyone outside the business. Grant access at the property level unless the SEO works on every property in your account, because account-level access flows down to all of them. GA4 also offers two data restrictions you can add to any role: **No Cost Metrics** and **No Revenue Metrics**. If your SEO has no need to see what you spend on ads or what you earn per order, switch those on. ## Google Business Profile: Manager, never primary owner From Business Profile settings, then People and access, an owner can invite someone as an **Owner** or a **Manager**. Google says managers have mostly the same access as owners: they edit business information, reply to reviews, post updates, add photos and products, and download performance data. They cannot add or remove people or delete the profile. That is the right fit for nearly all local SEO work. The **primary owner** is the one account that can hand the profile to someone else. Keep it in the business. A primary owner cannot remove themselves until they transfer the role, so a profile whose primary owner is a departed agency is a profile you will spend weeks recovering. Google also applies a seven-day waiting period to every new owner or manager, during which they cannot delete the profile, remove other people, or transfer primary ownership. Plan around that week rather than discovering it on deadline. The person you invite needs their own Google Account, and Google Groups cannot be added. ## WordPress: a named account, removed afterward WordPress ships with five roles. An **Editor** manages every post and page, including other people's, but cannot touch plugins, themes, or site settings. An **Administrator** can do everything, including installing code. Content work fits Editor. Most SEO plugin settings, redirects, and sitemap options sit behind Administrator, so technical SEO usually needs it. Create a separate administrator account in the SEO's own name and email, never your own login. That keeps their changes traceable in any activity log and lets you delete the account, and reassign its content to you, on the last day. ## Shopify: a collaborator account with a request code Shopify gives outside help its own door. A collaborator account reaches only the sections of the admin you approve, and it does not use up one of your staff seats. Under Settings, then Users and permissions, then Collaborators, you can require a **collaborator request code**, so only people you have given the code can even ask for access. Shopify's help center says the code requirement is on by default. Generating a new code invalidates the old one, which is a tidy way to stop stray requests after a project. When the request arrives, approve only what the work needs. Product editing and online store themes cover most SEO tasks. Orders, customers, payments, and finances usually do not belong in the request. ## The day the work ends Access granted this way comes back in a few clicks per tool: - Remove the person from Search Console, and delete any verification file or DNS record they added. - Remove them in GA4 at both the account and property level, wherever they appear. - Remove them from People and access on every Business Profile, and confirm the primary owner is still yours. - Delete their WordPress account and assign its content to a staff user. - Remove the Shopify collaborator and generate a new request code. Keep a short list of every invitation you send during the engagement. Offboarding then becomes reading that list back. ## How I can help I can send you the exact invitations a piece of work needs and the role for each, so the first week goes to the work instead of to logins. If you are staring at a profile or property that a former vendor still controls, [book a call](https://calendly.com/chrisabraham/30) or reach me through [Upwork](https://www.upwork.com/freelancers/chrisjabraham). ## Let me help you with this If you'd rather have this done than do it yourself, it's exactly the work I do for clients. Tell me about your site and I'll tell you where I'd start. [Book a 30 minute call](https://calendly.com/chrisabraham/30) [Call +1 202-352-5051](tel:+12023525051) [Email cja@well.com](mailto:cja@well.com) Prefer to hire through Upwork? I'm [Top Rated there too](https://www.upwork.com/freelancers/chrisjabraham). ## Sources - [Search Console Help: Managing owners, users, and permissions](https://support.google.com/webmasters/answer/7687615) - [Analytics Help: Access and data restrictions management](https://support.google.com/analytics/answer/9305587) - [Business Profile Help: Manage owners and managers](https://support.google.com/business/answer/3403100) - [Shopify Help Center: Collaborator permissions](https://help.shopify.com/manual/your-account/staff-accounts/collaborator-accounts) - [WordPress Documentation: Roles and Capabilities](https://wordpress.org/documentation/article/roles-and-capabilities/) **[Christopher Abraham](https://christopherabraham.com/about/)** is an independent SEO consultant in Arlington, Virginia, Top Rated on Upwork with 100% Job Success, who writes from his own client work and checks every claim against primary sources. He has built websites since 1994 and practiced SEO since 1998. [How these pages are written](https://christopherabraham.com/about/editorial-policy/) · [LinkedIn](https://www.linkedin.com/in/chrisabraham) · [Upwork](https://www.upwork.com/freelancers/chrisjabraham)