If a former employee or old web company verified your site in Search Console, Google's warnings about hacks and penalties go to them. Verify it with an account your business controls and remove anyone who no longer needs access.

Who Google writes to

Search Console is where Google tells a site's owners about problems it has found: pages it cannot reach, spam pages added by a hacker, a penalty for unnatural links.

Those messages go only to the owners and users listed for the site.

On many small business sites, those are the web company that built it five years ago and an office manager who set it up with her personal Gmail address.

Nobody now working at the business has ever logged in. Some owners have never heard of Search Console at all.

Google keeps writing. The messages simply arrive somewhere nobody is reading.

What those messages cover

The first costs most when nobody sees it. Google may label the site as possibly hacked in its results, while the message explaining why sits unread in someone else's inbox.

Owners, users and what each can do

A verified owner has proved control of the site, usually by uploading a small file, adding a tag to the home page, using the site's Analytics or Tag Manager code, or adding a record at the domain registrar.

Verified owners can add and remove everyone else, change settings that affect how the site appears in Google, and temporarily hide pages from the results.

They can also add delegated owners, who get nearly the same powers without proving anything themselves, along with full users, who see all the data, and restricted users, who see most of it.

A verified owner keeps that position for as long as the proof stays on the site. A file uploaded in 2011 is still doing its job today.

Adding the business's own account

Use a Google account created on an email address the business controls, such as the general office address, rather than any one person's Gmail. A Google Apps for Work account in the business's name serves just as well.

Add the site in Search Console and choose a verification method. The home page tag or the uploaded file is quickest; a record at your domain registrar survives redesigns and changes of host.

Where possible, verify with two methods. A redesign that drops the tag then does not quietly drop the business's ownership with it.

If your web company still looks after the site, it should keep its own access alongside yours. The point is that the business holds a master key, not that the web company loses its copy.

A worked example

A psychologist in private practice shares a small office suite with two colleagues. The website was built six years ago by a web company that has since closed.

That company had verified the site with a file on the server. A practice manager who left two years ago had been added as a full user, under her personal Gmail address.

This spring a client mentioned that the practice's result in Google carried a warning that the site might be hacked. Pages of Japanese text selling counterfeit brand-name goods had been added through an outdated plugin.

Google had found them weeks earlier and sent a message explaining what it saw and how to request a review. It went to an address at a closed company and to a former employee's personal inbox.

The site was cleaned and updated, the practice verified it under a Google account on the office's own email address, and the review was requested. Google removed the warning once it had checked the site again.

The old company's file was then deleted and that owner unverified, and the former manager was removed as a user.

Checking who has access

Once the business is verified, the settings menu for the site leads to a page listing every owner and user with their email address, and to a page showing how and when each owner verified.

Check every version of the site. Search Console treats the addresses with and without www, and with http and https, as separate sites, and access to one does not carry over to the others.

Removing people who no longer need access

Full and restricted users can be removed directly from the users page with a couple of clicks.

Verified owners take one more step. Their proof has to come off the site first: delete their file from the server, remove their tag, or ask whoever manages the domain to remove their record.

Then use the option to unverify them. Search Console refuses while the proof is still in place, and an owner whose file stays on the server would simply be verified again.

Delegated owners can be removed by any verified owner, which is one more reason the business should be one.

Making sure messages reach someone

Search Console can send its messages by email as well as keeping them in its own message list. Check the preferences on the business account so they arrive in an inbox, not only inside the tool.

Choose an inbox someone actually reads every day. A shared address that nobody owns is only slightly better than a former employee's.

If a web company maintains the site, agree that it receives the messages too and tells you when one matters. Most are routine; a few are urgent.

The counter-case

A site launched recently, by a web company that set up Search Console under the business's own account from the start, needs only a quick look at the users page.

And where the old web company still maintains the site and forwards every message promptly, nothing has been missed so far. The risk lies in the day that arrangement ends.

Either way, the business should be a verified owner in its own name, with messages going to an inbox someone reads.

Before the next warning

  1. Find out who set up Search Console originally.
  2. Create a Google account on a business email address.
  3. Verify the site under that account.
  4. Add a second verification method as a backup.
  5. Remove users who no longer need access.
  6. Unverify old owners once their proof is gone.
  7. Send messages to an inbox someone reads.

Step three matters most, because nothing after it can happen without it. Until the business is a verified owner itself, it cannot see who else has access, let alone remove them.

Accounts left behind by departing staff follow the same logic as the mailbox of an employee who left.

Frequently asked questions

What does Search Console tell site owners?

It reports problems Google finds: hacked content, manual penalties, pages it cannot reach and mobile usability issues. Messages go only to the people listed for the site.

Why might nobody at my business see them?

Because the people listed are often a former employee or the web company that built the site, so the messages go to their addresses instead of yours.

How do I add my business as an owner?

Create a Google account on an email address the business controls, add the site in Search Console, and verify it with a file, a home page tag or a domain record.

How do I remove a former owner?

Delete their verification file, tag or domain record first, then unverify them. Search Console will not remove an owner whose proof is still on the site.

Should my web company keep its access?

If it still maintains the site, yes, under its own account and alongside yours. What matters is that the business itself is a verified owner.

Where should the messages be sent?

To an inbox someone reads every day, set in the business account's preferences, with your web company also receiving them if it looks after the site.

West Coast Media Solutions Inc. provides web design, web development, hosting, digital marketing, and business consulting to organisations across Canada, drawing on more than twenty-five years in the field.

Not sure who verified your site?

Send us the site address. We will help verify it under your own account and remove anyone who has left.

Start a Conversation