SEO agency red flags: how to tell a strategy from a sales script

The guarantee that cannot honestly be made

Google publishes advice for businesses hiring an SEO, and the sharpest line in it is unambiguous: no one can guarantee a number one ranking on Google, and you should be wary of anyone who claims to guarantee rankings, alleges a special relationship with Google, or advertises a priority submission service. That is not a rival agency being competitive. It is the search engine telling its own users what a scam sounds like.

The mechanism matters more than the warning. A ranking is not a property of your website; it is the output of a comparison between your page and every other page eligible for that query, recalculated per query, per location and per device, and refreshed continuously as those other pages change. An agency works on one side of that comparison and has neither sight of nor control over the other. A guarantee therefore requires a competitor standstill agreement, which nobody can arrange, or a redefinition of the promise.

The redefinition is where the guarantee usually hides, and it takes three recognisable shapes:

• First page or you do not pay — with the target terms chosen after signature, and set to phrases so specific nobody searches them. Ranking first for “affordable industrial gasket supplier Newport” is not a commercial event.
• Guaranteed traffic increase — met by counting branded search you already owned, by comparing a strong month against a weak baseline, or by including traffic that was never a person.
• Guaranteed number of top-ten keywords — met by tracking two hundred low-demand variants and reporting the twenty that moved.

None of this is fraud. It is a promise about a metric rather than about your business, and the tell is that the metric gets defined after you have agreed to it. If a guarantee is offered, ask for the exact terms, the measurement source, the review date and the remedy in writing before signing. Most guarantees stop being offered at that point, which tells you what they were for.

Reporting that measures nothing you can bank

The second-best predictor of a bad engagement, after the guarantee, is the shape of the monthly report. Bad reports are not empty. They are usually crowded, built from numbers that move reliably and mean very little.

What gets reported	Why it looks like progress	What it actually tells you
Average position across a tracked keyword set	The number goes up	Almost nothing, unless the set is fixed and weighted by demand. Google notes that a query in your Search Console data may not show your site when you run the same search yourself, because results are personalised and localised
Impressions up by some percentage	Growth	Impressions can rise because you now rank badly for more queries, or because a new result type appeared. A leading indicator at best
Domain authority or trust score	An authoritative-sounding grade	A third-party vendor estimate of link strength. Google does not publish or consume it. Useful as a rough comparison, worthless as a target
Number of ranking keywords	Coverage is expanding	Includes hundreds of positions past the second page, which receive effectively no clicks
Backlinks acquired	Effort and momentum	A count with no quality or relevance attached measures outreach volume
Hours worked or tasks completed	Diligence	The inputs to a retainer, reported as though they were outputs

What to require instead is unglamorous and much harder to fake. Non-branded organic clicks, separated from branded, because brand search usually reflects your other marketing rather than the retainer. Organic landing pages mapped to enquiries or revenue. And a change log — what was changed, on which URL, on which date — because attribution is impossible without one.

That last point matters more than it sounds. Google describes core updates as significant, broad changes made several times a year that do not target individual sites, and states plainly that there is no guarantee changes you make will produce a noticeable impact. A report attributing a movement during a core update month to last month’s three blog posts is not analysis. Reporting you can govern spend against has to be designed deliberately, which is a data and analytics problem before it is a search one.

Who owns your accounts, your data and your content

This is the section people skip and later regret. Access arrangements decide how expensive it is to leave, and they get set casually in the first fortnight when everyone is still friendly.

1. Search Console. Be the verified owner, ideally through a DNS record on a domain in your name; the agency should be a delegated owner or a full user. Google is explicit that a property must have at least one verified owner or nobody has access at all, and that if every verified owner is removed, remaining users and delegated owners lose access after a grace period. Google also recommends granting read access only at the initial audit stage.
2. Analytics. The property should sit in an account your organisation owns. Only the Administrator role can manage users, and account-level roles cascade to every property beneath them, so check the level at which access was granted rather than the name on the list.
3. Google Business Profile. Be the primary owner. Managers can do nearly everything except add or remove users and delete the profile, and newly added owners face a waiting period before they can remove others or transfer ownership. If an agency is running local search work for you, this is the account most likely to become a hostage.
4. Domain and DNS. The registrar account should be in your company name with your billing details on it. Almost everything else is recoverable quickly. This one is not.
5. Content and documentation. Under UK law the first owner of copyright in a commissioned work is the creator, not the person who paid, unless assignment is agreed in writing. Paying an invoice is not an assignment. Ask whether you receive an assignment or a licence, and what happens to that licence on termination.
6. Subcontracting. Ask directly whether the work is white-labelled, and to whom. Not automatically a problem — specialist subcontracting often produces better work than a generalist would — but you should know who is touching your site and where accountability sits when something breaks.

Volume dressed up as a content strategy

Google’s actual position on AI-generated content is not the one either faction quotes at you. The guidance does not prohibit automation. It says that using automation, including AI generation, to produce content primarily for the purpose of manipulating rankings violates the spam policies — and the relevant policy, scaled content abuse, describes many pages generated primarily to manipulate rankings rather than help users. The same guidance asks whether the use of automation is self-evident to visitors through disclosure.

So the red flag is not that a proposal involves AI. It is volume with no argument attached. The tells:

• The proposal is priced per article per month and nowhere states what decision each article helps a reader make.
• The topic list is visibly a keyword tool export, and contains four pages that are the same page with different phrasing.
• Nobody has asked who inside your business will be interviewed. Original information has to come from somewhere, and the only source of original information about your company is inside your company.
• The plan only adds. There is no provision for updating, consolidating or removing anything, which is how sites accumulate the thin pages that later require a pruning project.

The location-page version deserves its own warning. Two hundred pages of “service in town name”, differing only by the place name, is the pattern Google names as doorway abuse: pages built to rank for specific, similar queries that route users through something less useful than the destination. It is still sold, it still works for a while, and the downside sits on your domain rather than the agency’s. The honest alternative is fewer pages with genuine local substance, arranged as content clusters that build topical authority — slower, and much less impressive as a line item. Getting that right is what a serious content marketing engagement is for.

Link building that leaves a footprint

Google defines link spam as creating links to or from a site primarily to manipulate rankings, and names buying links and excessive exchanges among the examples. Every agency selling links knows this, which is why the language in proposals has become careful: digital PR, authority placements, niche edits, contextual insertions. Some of that is legitimate work. The distinguishing question is not what it is called, but whether the link exists for a reader.

A private blog network has a recognisable signature: a cluster of sites with thematically unrelated posts, thin or absent about pages, no organic traffic of their own, and a shared hosting, template or authorship footprint. Renting a subfolder on an established publisher’s domain has its own named policy now — site reputation abuse — and the fact that it needed one tells you how widely it was being sold.

When an agency explains why any of this is safe, hold two things in mind. The likeliest outcome of a bad link programme is not a penalty; it is nothing at all. Links get discounted algorithmically and quietly, and you have simply bought something that did not work. That is the boring, common, expensive case, and it is rarely mentioned in a pitch.

The uncommon case is worse than it is usually made to sound. Google issues a manual action when a human reviewer determines that pages breach the spam policies, and states that some or all of the site may then not be shown in search results. Fixing the issue on only some pages does not earn a partial return. Reconsideration reviews take days or weeks, and link-related requests can take longer than usual. The agency’s exposure to that outcome is losing a client. Yours is your pipeline.

A useful test costs nothing: ask to see three links built for another client last quarter, on the pages where they actually sit. Read the surrounding article and ask whether a real person would ever have clicked it. Talk of link velocity, meanwhile, is a mild tell in itself — vocabulary from the period when link building was a volume game, usually indicating that for this supplier it still is.

Contracts, lock-ins and notice periods

A twelve-month minimum term is not a red flag. Search work is slow, and an agency on a rolling monthly arrangement is being set up to chase quick, fragile wins to survive the next review. The red flag is a long minimum term with no defined deliverables. Commitment and specificity should move together.

The clauses that decide your position if it goes wrong:

• Notice period, and whether it can be served during the minimum term. A twelve-month term with three months’ notice that can only be served in month twelve is a fifteen-month contract.
• Auto-renewal and the cancellation window. Put the date in your own calendar rather than trusting a reminder from the party who benefits from renewal.
• What happens to access on exit. Named accounts, named roles, a defined handover of documentation.
• Ownership of what was produced. Content, technical specifications, tracking configuration, and any tool licences bought on your behalf.
• The definition of the retainer. Whether strategy hours are capped, whether unused hours roll over, and what happens in a month dominated by one large task.

Performance-based pricing deserves more scepticism than it gets. Paying on rankings sounds like alignment and is not: it rewards whatever moves a position fastest and leaves you holding the consequences. Paying on qualified leads is far more defensible, but only where the definition of qualified is agreed in writing, the attribution model is fixed in advance, and the agency has visibility of your CRM. Without those three you will spend the second quarter arguing about what counts.

The clean test: write down what you would still hold if the relationship ended tomorrow. Accounts, documentation, content, a technical baseline, an understanding of your own search demand. If the honest answer is close to nothing, the contract is the product being sold.

The proprietary-method tell, and claims that sound reasonable

Google’s hiring guidance warns specifically about SEOs that demand secrecy or will not clearly explain what they intend to do. It is a good rule with one refinement: proprietary tooling is real, and a firm may legitimately decline to hand over its internal scoring model or data pipeline. What it cannot legitimately decline to explain is what will change on your website and why. A method that cannot be described in a sentence a marketing director understands is either worth very little or something you would object to.

A handful of claims sound entirely reasonable and are not:

• “We have a contact at Google.” Google explicitly names an alleged special relationship as a warning sign.
• “We will submit your site to the search engines.” Submission as a service is not a thing; discovery happens through crawling, links and sitemaps. Google’s guidance names submitting your site to thousands of search engines as a warning sign in its own right.
• “Your SEO score is 43 out of 100 and we will get it to 90.” Those scores are heuristics invented by tool vendors. Nothing ranks because of one, and chasing a score reliably produces work nobody needed.
• “You have a Google penalty.” Possibly, but check the Manual Actions report yourself first. Most traffic drops are not penalties; they are a core update, a migration, a seasonal pattern, or a competitor who improved.
• “Google requires this.” Search Essentials separates a small set of genuine technical requirements from a much larger set of best practices, and meeting all of them makes content eligible to appear rather than guaranteed to. Most “requirements” quoted in audits are the audit tool’s opinion, and sorting real constraints from tool noise is what a competent technical SEO review is for.
• “We can pay to have you indexed faster.” It does not cost money to appear in Google’s results, and paid inclusion does not exist.

What a credible proposal looks like instead

The difference is visible on the first page, before any tactic is named.

A credible proposal opens with a diagnosis rather than a package. It names the constraint it believes is limiting you — indexation, intent mismatch, shallow coverage of a topic your buyers research, internal linking that strands your commercial pages, slow templates, an absent local presence — shows the evidence that led there, and states a hypothesis you could falsify.

It says what will be measured, from which source, and what a null result would look like; an agency willing to describe in advance the outcome that would mean its approach had failed is one planning to tell you the truth in month seven. It says what they will not do, and why. And it names what depends on you — interviews, approvals, developer capacity — because unimplemented recommendations are the most common cause of a failed search engagement.

The best ones include a version of “you may not need us”. A business with forty pages, no content owner and a site nobody internally can edit does not yet have a search problem; it has a capacity problem, and the honest advice is to fix that first. The same discipline applies when you are briefing a development partner, and our own view of how search work should be scoped begins in the same place: diagnosis before package.

Ten minutes of questions that separate the two

Ask these in a first call. Listen for specificity, for a willingness to say “I do not know yet”, and for whether they ask you anything back.

1. What do you think is currently limiting our organic performance, and what evidence points to that?
2. Which three pages would you change first, and what exactly would change on them?
3. What will you not do for us?
4. How will we know in six months whether this worked — and what result would make you tell us to stop?
5. Can I see a monthly report you send another client? Redacted is fine.
6. Who does the work, and is any of it subcontracted?
7. What access do you need on day one, and can we start with read-only?
8. If we ended the contract, what would we keep?
9. Has a client of yours ever received a manual action, and what happened next?
10. What would make you turn this engagement down?

Four and ten are the most diagnostic. An agency that has never turned work down is either very new or not being straight with you, and one that cannot describe its own failure condition has not thought about your business for longer than it took to assemble the deck.

How to audit work that has already been done

If you are already inside a retainer and unsure about it, this sequence takes an afternoon and needs no third-party tool.

1. Open Search Console yourself. Manual Actions and Security Issues first. Sixty seconds, and it settles the penalty question definitively.
2. Widen the Performance report. The default view covers three months, which is too short to see anything structural. Compare the last twelve months against the twelve before, and split branded from non-branded queries. Branded growth usually belongs to your other marketing.
3. Read the content. Pick three pages published during the engagement at random. Ask whether you would send any of them to a customer who had asked a real question.
4. Sample the links. Take twenty referring domains gained in the period and open them. You are not scoring them; you are asking whether you are pleased to see your brand there.
5. Check the technical work happened at all. Sitemaps, robots directives, redirect chains, internal links into your commercial pages. A technical retainer that has never touched any of these is not a technical retainer.
6. Ask for the change log. Dates, URLs, changes. If it does not exist, you have your finding, and no report produced during that engagement can be trusted to mean what it says.
7. Read three months of invoices against three months of deliverables. Not to catch anyone out, but because a mismatch, where there is one, is obvious the moment the two sit side by side.
8. Secure access before you act. Verify Search Console ownership with a token you control, confirm your Administrator role in Analytics, confirm primary ownership of the Business Profile. Do this before any difficult conversation, not after it.

Most of what this article describes is not fraud. It is what happens when an agency optimises for retention rather than outcome: reporting that always contains good news, deliverables that are countable rather than consequential, contracts that make leaving expensive. Those incentives produce mediocre work far more often than dishonesty does, and all of it is perfectly legal — which leads to the uncomfortable conclusion. A client who cannot distinguish good search work from an expensive impression of it will eventually receive the second one, whoever they hire, because the market has no particular reason to supply anything better. The ability to read a report sceptically, check your own Search Console and ask question four is worth more than any single vendor decision, including this one.