Audit Your SEO Agency's Work: Finding Out What Was Done in Your Name, and Getting Your Accounts Back

Do this before the awkward conversation, not after it

Order matters more than speed here. Keep things civil and quiet until you have read access to everything. Not because your agency is dishonest; you do not know yet, and that is the point. A vendor you have just accused has little reason to hand you a clean export. A vendor who gets a routine request for access has every reason to.

This page is the fuller version of the one-afternoon warning-signs check. That page asks whether something looks wrong. This one asks what happened, month by month, and whether you got what you paid for. Budget a day or two. Be realistic about what it will produce. Search Console's Links report is a sample, change logs are incomplete, and some of what a vendor did may leave no trace. You will end with a strong picture, not a complete one.

Get in the door first: account by account

Each provider has its own route back in. These come from their own help pages, as read in November 2026. We are not lawyers: a dispute over who owns an account or domain is a question for your own attorney, and we cannot promise any of these will work in your case.

Two warnings from the same pages. ICANN says a change of registrant can lock a domain against moving to another registrar, so ask your registrar before you change the name on it. And ICANN says it has no contractual authority to require a registrar to transfer a domain back after an unauthorized transfer. So nobody can promise you the domain will come back, and if it is not in your name, this is the first thing to get on paper.

What Search Console can reconstruct, and where it stops

Once you are an owner, Search Console holds more history than most people realize. Start with who has been in the building. Under Users and permissions, Google's ownership help page says Ownership history shows owners added and removed, along with successful and unsuccessful verification attempts. For another owner, the more icon opens the tokens and methods that verified them. Any owner you cannot place deserves a question: Google says an unrecognized owner might mean the site was hacked.

• The Manual actions and Security issues reports. Google keeps them separate: one is mostly manipulation, the other mostly hacking or harm to visitors. Our guide to Google's spam rules explains how to read each notice.
• The Performance report, over the longest range it offers. Look for sudden steps in clicks and write down the dates. You will set them against the invoices, and against Google's dashboard of updates.
• The Links report. Top linking sites, top linked pages and top linking text. Google says link text is grouped by exact match and sorted by count, which makes supplied wording easy to spot.
• The disavow tool. A past agency may have uploaded a list. Google says each property has one list and a new upload replaces the old one, so look before you touch it. The tool does not support Domain properties.

Hold the backlink export against the invoices

Now do the part that takes patience. Google's Links report help, read November 7, 2026, says you can export up to 100,000 rows from the Latest links and More sample links slices, as a CSV or Google Sheet, while tables on screen stop at 1,000 rows. Take both. Add a second source: Microsoft described Bing Webmaster Tools as free in a June 17, 2025 post, and as of November 2026 Ahrefs says its free tier shows up to 1,000 backlinks for verified sites. Put them in one sheet and remove duplicates. Remember the limits. Google's report is a sample, may include links since removed and does not show nofollow.

Then set each invoice line beside what you can see. The invoice is the claim. The table below shows the evidence that would back it. Do not expect perfection, since a real vendor may have done work that leaves little trace. Do expect them to be able to tell you about it when asked. Our guide to running a backlink audit has the step-by-step for the links themselves.

Change history: the site, the ads and the old pages

Backlinks are one half of the record. The other half is what changed on your own properties. Google's hiring page suggests you ask an SEO to share all the changes it makes, and if it did not then, the systems may still remember. Each source below sees only its own patch. Together they usually give you a timeline you can lay against the traffic.

1. 1

   Google Ads change history

   If the agency also ran ads, Google Ads Help, read November 7, 2026, says change history lists changes to the account, campaigns and ad groups for the past 2 years, with the email address of the person in the User column. Older data is not available.

2. 2

   Your content system

   Most systems keep page revisions, plugin lists and user accounts. Look for admin logins you do not recognize, plugins nobody can explain and pages edited in bulk. An injected redirect or hidden link usually lives in a template or plugin, not on a page.

3. 3

   Your hosting and DNS

   Check the file dates on the server, any redirect rules, and which verification records sit in DNS. A record for a service you never bought is worth one phone call.

4. 4

   Archived copies of old pages

   The Internet Archive's Wayback Machine may hold snapshots of your site. It says coverage is incomplete and pages can be broken, so a gap proves nothing. When it has a copy, you can see the footer as it stood in a given year.

5. 5

   Email, purchase orders and bank records

   Search for the vendor's name, plus words like placement, publisher and sponsored. A separate charge for "content distribution" is worth a question. These take less time to read than the link export did, and they sometimes say more.

Score it fairly: a dull agency is not a crooked one

You will be tempted to read everything in the worst light, since you are out of pocket and somebody charged you for it. Resist that. Google's starter guide, last updated December 10, 2025, says some changes could take several months, and it says on another page that a page meeting every requirement is still not assured of being crawled, indexed or served. Flat results alone do not prove misconduct. Our page on gray hat tactics sets out where the argument gets harder.

On that last row, Google's hiring page, last updated June 5, 2026, says "Ultimately, you are responsible for the actions of any companies you hire." It also says that someone deceived by an SEO in the United States can complain to the Federal Trade Commission. We cannot tell you whether you have a claim. Your attorney can, and your records will be the first thing they ask for.

The last day: taking the keys back in the right order

Whenever the relationship ends, do it in this order. Mistakes here cost more than the audit did. The Search Console step is the one most often skipped, and it is the real version of the old joke about the agency that keeps your Google account.

1. 1

   Confirm your own access everywhere

   Admin on the ad account, primary owner on the Business Profile, your own token in Search Console. A new Business Profile owner or manager waits 7 days before removing users or transferring primary ownership, so start early.

2. 2

   Export what you may lose

   Links, Performance data, Ads change history, reports and the vendor's link record. Ask for any disavow file and its reasoning.

3. 3

   Give notice as the contract says

   Check the term and notice period. Then ask in writing for a final list of work, links and open items. A vendor who handed you documents all along will find this easy.

4. 4

   Remove people, then remove their tokens

   In Search Console, Google says a removed verified owner loses access at once but can re-verify unless all their tokens are deleted. Delete their file, tag or DNS record, then check the unused tokens list. Keep your own token in place: Google warns that if all verified owners are removed, the other users lose access too.

5. 5

   Close the other doors

   Unlink the manager account from Google Ads, keeping in mind that Google notes an account with one administrator may lose access to its tags if that person becomes unavailable. Remove logins from the site, hosting and DNS. Change shared passwords.

6. 6

   Watch for a return visit

   Google says current owners are notified if a removed owner re-verifies, so read that email if it comes. Then check Users and permissions once more next month.