SEO Consultant Red Flags and Warning Signs

Why do SEO red flags matter more than most buying mistakes?

Search engine optimisation is easy to sell and hard to inspect. The work happens in code, content and external links that most buyers cannot see, and the results arrive slowly enough that a poor provider can look busy for months. That combination makes red flags unusually valuable: they are the cheapest early signal that a relationship will not end well.

The cost of ignoring them is not only wasted budget. Google's published spam policies describe practices that can lead to a page or a whole site being demoted or removed from results. A consultant who uses those practices does not just fail to help. They can leave you worse off than if you had done nothing.

How does Google frame the risk?

Google's "Do you need an SEO?" guidance says you are responsible for the actions of any company you hire. It also warns that if an SEO creates deceptive or misleading content on your behalf, your site could be removed from Google's index. The guidance was last updated on 5 June 2026.

This shifts the question from "will it work?" to "can I defend it?". If you could not explain a tactic to Google, to a regulator or to your own customers, it should not be on your site.

What counts as a red flag versus a mistake

A red flag is a behaviour that signals misleading, careless or unsafe practice. A mistake is an honest error that a competent provider corrects. The distinction matters because everyone makes mistakes, but red flags are patterns.

Why are these signs easy to miss?

Most red flags sound like confidence. "We know exactly how to rank you" feels reassuring on a sales call. Secret methods feel like expertise. Cheap link packages feel like a bargain. Your job is to translate each claim into a testable statement and ask for evidence.

The sections below group the warning signs by where they appear: in the pitch, in the method, in the delivery and in the reporting. Use them as a checklist during calls and again during the first months of work.

Which red flags show up in the sales pitch?

The pitch is where the first warnings appear, because it reveals what the seller believes you want to hear. The most reliable signals are promises that no honest provider could keep.

Google's guidance lists several of these directly, and they are worth treating as automatic disqualifiers.

Does the consultant guarantee rankings?

Google says that no one can guarantee a number one ranking on Google, and that anyone who promises one should be avoided. The reason is simple. Rankings are produced by a system that the consultant does not control and that changes continuously.

Some providers soften the claim: "guaranteed first page for low-competition terms" or "money back if we do not rank". These are still problematic, because the terms chosen for the guarantee are often so narrow or branded that ranking for them delivers no customers.

How to test a softened guarantee

Ask which exact keywords are covered, how many searches they receive per month, and whether those searches would send you customers. A guarantee on terms nobody searches for is a marketing device, not a result.

Do they claim a special relationship with Google?

Phrases such as "Google partner access", "priority submit" or "we have contacts at Google" are warnings. Google's guidance specifically calls out claims of a special relationship or priority submission. Google does not sell ranking influence, and organic results are not for sale.

Be careful with badges as well. Certain advertising programmes have partner tiers, but those relate to paid advertising, not organic search. A badge in the footer says nothing about organic ranking ability.

What a legitimate Google credential means

Credentials such as analytics or advertising certifications show training on tools. They do not prove skill at organic search strategy. Treat them as a minor positive, not as proof.

Did they contact you first?

Unsolicited emails that claim to have found problems with your site are common. Google's guidance notes that such cold emails are often spam. They typically attach a generic report, flatter you with a fake discovery and push for a quick call.

The safest response is to ignore the email, avoid clicking links and check any claim yourself in Google Search Console. If you want help, choose a provider through research and references rather than through an inbound message.

Which red flags appear in the methods they use?

Method red flags are the most dangerous, because they can cause lasting harm. Google's spam policies provide an objective test, since each named practice is something Google says can lead to demotion or removal.

The policy page, last updated on 28 August 2026, lists sixteen practices: cloaking, doorway abuse, expired domain abuse, hacked content, hidden text and link abuse, keyword stuffing, link spam, machine-generated traffic, malicious practices, misleading functionality, scaled content abuse, scraping, site reputation abuse, sneaky redirects, thin affiliation and user-generated spam.

Which spam tactics are sold as SEO?

Several of the listed practices are sold openly. Link spam appears as "high-authority link packages" or private blog networks. Scaled content abuse appears as thousands of generated pages produced for search rather than for users. Doorway abuse appears as hundreds of near-identical location pages. Expired domain abuse appears as buying an old domain to lend authority to unrelated content.

The table below translates common sales phrases into the policy they may breach.

Why a short-term lift proves nothing

Some spam tactics do produce a temporary rise before a demotion. A consultant who points to a quick gain from a tactic on the list is describing the risk, not the reward.

Do they refuse to explain what they change?

Secrecy is a red flag even when the tactics are harmless. Google's guidance lists secrecy as a warning sign and says an SEO should explain their reasoning and document changes. If they will not tell you what they are doing, you cannot judge whether it is safe, and you cannot undo it.

Phrases such as "proprietary method" or "we cannot reveal our process" often hide ordinary work sold at a premium or risky work sold as a secret. A good consultant protects clients by being clearer, not by being more mysterious.

What a clear explanation sounds like

"We are changing the title tags on the twelve service pages because they do not match the main search terms, and we will check click-through in Search Console after four weeks." That is specific, reasoned and testable.

Are they asking you to link to them?

Google's guidance says you should never need to link to your SEO. Footer credits, "built by" links and reciprocal arrangements can look innocent but create a relationship that benefits the provider more than you.

If a provider wants a sitewide link as a condition of work, ask why. A genuine agency may ask for a credit on a project page, but it should not be required and should not use keyword-rich anchor text.

What access requests should make you cautious?

Access requests reveal risk appetite. An SEO consultant needs enough access to do the work, and no more. Requests that go further without a clear reason are worth challenging.

Google's guidance recommends limiting access, suggesting that for an initial audit you grant read-only Search Console access and not write access.

Should an SEO have admin access on day one?

Not usually. A diagnostic audit can be done with read-only analytics, read-only Search Console and a public crawl. Full administrator access to your content management system, hosting or domain registrar is a bigger step that should follow a defined scope.

A consultant who demands everything before explaining anything is either careless with your security or planning more than they have disclosed. Ask them to justify each permission in writing.

Which accounts should always stay in your name

Your domain registration, your hosting account, your Google Business Profile and your analytics properties should belong to you. A provider who insists on registering them in their own name creates a dependency that is painful to unwind.

What if they ask for server or FTP access?

Server-level changes can be legitimate, for example redirects or performance fixes. Google says that if an SEO has FTP or server access, they should explain every change they make. Without that explanation, you are trusting someone with the ability to alter your site invisibly.

Ask for backups, a staging environment where possible, a rollback plan and written approval for every release. If the consultant treats those requests as obstacles, that is information.

Which red flags appear in delivery and communication?

Once work starts, the warning signs shift from what is said to what happens. Delivery red flags are subtle, and they often appear gradually.

Watch the pattern over the first two months. A single late report is a mistake. Three late reports with no explanation is a pattern.

Is the work visible and documented?

You should be able to see what has been done at any time. That means a change log, a task list or a ticket board, and a regular report that connects work to outcomes. If the only evidence of progress is a monthly PDF, you are being asked to trust, not verify.

Look for specifics: which URLs changed, what was added or removed, which recommendations are waiting on you. Vague phrases such as "optimised on-page factors" without detail are padding.

What a useful monthly update contains

Work completed, work planned, blockers, key metrics with context and a short list of decisions needed from you. One or two pages are enough.

Do they respond to questions?

Communication speed is not everything, but evasiveness is. A consultant who answers questions with more jargon, changes the subject or becomes defensive when asked for evidence is signalling that the answers may not hold up.

Test this early. Ask a simple question about a recommendation and see whether the reply explains the reason, cites a source and admits uncertainty where it exists.

How to handle a defensive response

Restate the question calmly and ask for the evidence in writing. A confident professional will provide it. If the response is hostility or silence, escalate or end the engagement.

What are the warning signs in reporting?

Reports are where weak providers hide. Because organic search results can be noisy, a report can always find something positive to show, and a persuasive layout can make small movements look like wins.

Good reporting ties activity to outcomes, shows uncertainty and separates correlation from cause.

Are rankings the only metric?

Rankings are useful but incomplete. They vary by location, device and personalisation, and a tracked list of keywords is a chosen sample, not the whole market. A report that leads with ranking positions and never mentions enquiries, sales or qualified traffic has skipped the point.

Ask for metrics that connect to your business: leads from organic search, calls, form submissions, revenue where measurable, plus supporting data such as impressions and clicks from Search Console.

Why vanity metrics are tempting

Impressions, average position and keyword counts rise easily when you target more terms, including irrelevant ones. They can grow while real business value does not. Treat them as supporting evidence only.

Do the numbers match your own data?

Check the report against your own Search Console and analytics. If the consultant reports traffic or conversions that you cannot find in your own accounts, ask why. Differences can have innocent causes, such as filters or time zones, but unexplained gaps deserve an answer.

Make sure you own the accounts that supply the numbers. If the reporting depends on a dashboard you cannot inspect, you are relying entirely on the provider's version of events.

How do you check a consultant's claims and credentials?

Verification turns suspicion into evidence. Many red flags can be confirmed or dismissed within an hour of research.

You do not need technical skill for most of this. You need to read carefully and ask for documents.

What can you verify yourself?

Check that the business exists on Companies House, that the website is professional and technically sound, that named case studies match real brands and that the people described actually exist. Look for reviews on independent platforms, noting that a handful of identical five-star reviews is itself a warning.

Search for the consultant's own business. Providers do not need to rank first for every term, but a consultant who sells SEO should show basic competence on their own site.

How to read reviews with care

Look for specific, varied reviews written in different styles and spread across time. Reviews that only praise "great service" with no detail are weak evidence, and clusters posted in a single week are suspicious.

Should you contact references?

Yes, and ask open questions. Google suggests asking past clients whether the SEO was helpful, easy to work with and produced results. Add questions about what went wrong, how problems were handled and whether the client would hire them again.

If a consultant cannot provide any references, ask why. Confidentiality can be genuine, but a provider with years of experience can usually arrange at least one conversation.

What do red flags look like for specialist work?

Some services carry extra risk because mistakes are expensive. Migrations, international setups and local listings are examples where a poor consultant can do harm quickly.

Apply the same principles with more care and ask for more detail on method and rollback.

What goes wrong in website migrations?

A migration changes URLs, templates and sometimes platforms at once. Red flags include no inventory of existing URLs, no redirect map, no pre-launch testing on a staging site and no monitoring plan after launch. A consultant who says "redirects are simple" without a mapping process has not done many migrations.

Ask for the checklist they use. If it is thin, or if they plan to launch without benchmarking current rankings and traffic, the risk of an avoidable loss is high.

What a safe migration plan includes

An inventory of URLs, a mapped redirect for every important page, staging tests, a launch-day check, monitoring of crawl errors and indexing, and a defined window for fixes.

What goes wrong with local listings and reviews?

Local SEO has its own temptations: fake reviews, keyword-stuffed business names, virtual office addresses and duplicate listings. These breach Google Business Profile guidelines and can lead to suspension, which removes a business from local results entirely.

A consultant who proposes buying reviews, offering incentives in exchange for positive ratings or using an address where you have no presence is putting your listing at risk. Walk away from any such suggestion.

What should you do when you spot a red flag?

Spotting a red flag is not the end of the conversation, but it should change your behaviour. The response depends on whether the flag appears before or after you hired the consultant.

Act proportionately: ask, document, then decide.

What should you do before signing?

Raise the concern directly. Ask for the evidence or the explanation, and see how the consultant reacts. A good provider welcomes scrutiny and may even change their proposal. A poor provider becomes evasive.

If the red flag concerns a guarantee, a special-access claim or a spam tactic, there is little to negotiate. Choose another provider and note the experience for your shortlist.

How to decline without burning bridges

Thank them for their time, say you have chosen a different approach and keep the message short. You do not owe a detailed critique.

What should you do if you are already in a contract?

Start by securing your accounts: change shared passwords, review who has access and make sure you own every property. Ask in writing for a full change log and copies of all deliverables. Then commission an independent review to check whether any work breaches Google's policies.

If harmful changes are found, reverse them and document the clean-up. If Google has applied a manual action, you may need a reconsideration request after the issues are fixed. Checking whether it's a manual action or a ranking decline is the first step, and an SEO traffic recovery consultant can help where the damage is serious.

How to end the engagement cleanly

Follow the notice terms in your contract, put the decision in writing, arrange handover of documents and remove access on the final day. Keep copies of everything delivered.

How can you build a simple red-flag checklist?

A checklist makes the lessons practical. Turn the warning signs into questions you can answer during calls and review each quarter once work is under way.

Use it as a scoring tool, not a blunt instrument, and weigh the most serious items most heavily.

What belongs on the checklist?

Group the items by stage so that you use the right ones at the right time. The table below shows a compact version.

How to keep the checklist honest

Fill it in after each call, not during, and ask a colleague to review your scores. A second opinion catches wishful thinking.

How often should you review the relationship?

Review quarterly. Ask whether the work still matches the plan, whether the reports still make sense, whether the access is still appropriate and whether the evidence supports continuing. Providers change, staff leave and processes drift.

A short written review keeps both sides accountable and makes it easier to adjust scope or end the engagement before problems grow. For a wider view of selection, read how to choose an SEO consultant in London and the questions to ask before hiring.

What does a trustworthy consultant look like by comparison?

Red flags are easier to spot when you know the opposite. A trustworthy consultant tends to share a recognisable set of habits that you can look for from the first call.

They are not perfect, and they do not claim to be. They are transparent about method, honest about uncertainty and focused on your outcomes.

Which habits signal good practice?

They ask about your business before pitching. They explain trade-offs, including what they would not do. They give ranges and timeframes with assumptions. They cite official documentation where it applies. They document changes and welcome questions. They are comfortable saying "I do not know yet, and here is how I would find out".

They also tell you when SEO is not the right investment. A consultant who says that your business would benefit more from fixing the website's conversion, or from paid search in the short term, is prioritising your outcome over a sale.

Why honesty about limits builds trust

Admitting that organic results take time, that algorithm updates can change outcomes and that some goals are not realistic with your budget makes the rest of the advice more credible.

How does this connect to the service you buy?

When you choose a provider, you are buying judgement as much as labour. The red flags in this guide are all failures of judgement or honesty. The best protection is a process built on evidence: an audit that shows what is wrong, a plan that ranks the fixes, and reporting that shows what changed.

If you want a second opinion on a proposal or on work already done, a short independent SEO audit is a low-cost way to establish where you stand before you commit more budget.

How do red flags play out in realistic scenarios?

The examples below are hypothetical and labelled as such. They are composites of patterns that site owners commonly describe, not accounts of any named business, and they show how a red flag turns into a decision.

Scenario one: the guarantee that came with a catch

A hypothetical London dental practice is offered a guaranteed first-page ranking in ninety days for a monthly fee. On reading the contract, the guarantee covers only the practice's own name and two obscure phrases that nobody searches. The practice already ranks for its own name, so the guarantee costs the provider nothing.

The lesson is to read the definition of success in the contract. The tell is a guarantee that only covers terms you already own or that no customer would type.

What the practice should have asked

Which terms, which location, which device, which date and measured with which tool? Each answer narrows the promise until its real size is visible.

Scenario two: the page factory

A hypothetical trades business is sold a plan to publish a page for every London postcode district, each with the same text and a different place name. Rankings dip after an initial lift, and several pages drop out of the index.

This is the pattern Google's doorway abuse policy describes: many similar pages built to capture variations of a search rather than to help users. The fix is to consolidate, keep only locations where the business has real evidence and content, and redirect the rest.

How to recognise a doorway plan early

If a plan lists page counts before it lists reasons, it is probably about volume. Ask what unique value each page offers a customer who lands on it.

Scenario three: the report that never mentions money

A hypothetical online shop receives a monthly report of ranking charts and a line chart of "authority score". Sales from organic search are never shown. After six months the owner discovers that organic revenue is flat while the charts have risen.

Rankings for broad, low-intent terms and a third-party authority number can both climb without any commercial effect. The corrective is to agree the key metrics before work starts and to include revenue or qualified leads in every report, with a note on how they were measured.

What a better dashboard shows

Organic sessions, organic leads or orders, conversion rate, revenue where available, and a short list of the pages and queries driving them, all taken from accounts you own.

Scenario four: the consultant who would not explain

A hypothetical law firm hires a consultant who edits pages directly in the content management system and sends a monthly summary of "technical improvements". When rankings fall, the firm cannot find out what was changed or when.

The remedy is a change log from the first day, with dates, URLs and reasons, and an agreement that nothing is changed on the live site without approval. Without it, diagnosing a drop becomes guesswork. Diagnosing an organic traffic drop becomes much easier when changes are recorded.

What to do when documentation does not exist

Reconstruct a timeline from website backups, version history and Search Console data, then ask the consultant for their notes. Make documentation a condition of any future work.

Is a red flag ever a false alarm?

Not every warning sign means a bad provider. Some behaviours look alarming but have ordinary explanations, and treating them as proof of bad faith can cost you a good consultant. The aim is to weigh evidence, not to reject everyone.

Use two questions to separate a false alarm from a real problem: is there a plausible innocent explanation, and does the consultant offer it openly when asked?

Which behaviours are often misread?

A consultant who declines to forecast an exact traffic figure is being honest, not evasive. A consultant who asks for access to your analytics early may need it to diagnose, provided it is read-only. A consultant who recommends deleting pages may be pruning thin content, which Google's guidance supports when pages offer little value.

Likewise, a high fee is not a red flag if the scope, seniority and deliverables justify it, and a low fee is not a red flag if the work is small and clearly defined. The signal is in the clarity of the explanation, not in the number itself.

How to ask without accusing

Frame the question as a request for understanding: "Help me understand why you recommend this, so I can explain it to my team." That wording invites a full answer and makes it easy to see who is comfortable explaining their work.

When should you give a consultant a second chance?

If a mistake is acknowledged quickly, corrected properly and explained honestly, it is a sign of professionalism rather than a reason to leave. Everyone ships an error eventually, such as a redirect that points to the wrong page or a tag that blocks a section by accident.

What matters is the response. A provider who reports the issue before you find it, fixes it and puts a check in place to prevent a repeat is behaving exactly as you would hope. A provider who hides it, blames others or repeats the same error is not.

What a good incident note includes

What happened, which pages were affected, for how long, how it was fixed, what the impact was and what has changed to prevent it. A short note is enough, and its existence is the point.