SEO Client Onboarding Checklist: The First 30 Days

A good SEO onboarding gets you the right access without anyone sharing a password, records a dated baseline before you change anything, and agrees in writing what the first 30 days will deliver.

It is for agency owners, account managers and freelancers with a newly signed client. Still pitching? Read how agencies use audits for prospecting first.

How do you get client access without sharing passwords?

Ask the client to invite your own named Google account or CMS user to each tool at a specific role. Every platform below supports invitations, so a shared login is never needed. Named access shows who did what, and removing you needs no password reset.

Google's “Do you need an SEO?” guide sets the baseline: when an SEO offers an audit, site owners should grant only read access to Search Console at that stage. Ask for more once the engagement justifies it.

What each role allows

• Search Console: owners (verified by token, or delegated) have full control and manage users. Full users see all data and take some actions. Restricted users view most data.
• GA4: Administrator, Editor, Marketer, Analyst and Viewer. Editors control property settings but can't manage users. No Cost Metrics and No Revenue Metrics restrictions hide those figures.
• Business Profile: one primary owner, plus owners and managers. Managers can't manage users or remove the profile. New owners and managers wait 7 days before removing users or transferring primary ownership.
• Tag Manager: containers allow No access, Read, Edit, Approve or Publish.
• WordPress: an Editor publishes and manages everyone's posts. An Administrator has every administration feature of a single site.

How the client adds you to Search Console

1. Open the property. Choose the Domain property if one exists.
2. Go to Settings > Users and permissions. Only owners see this page. If it's missing, the person needs to ask whoever owns the property.
3. Click Add user. Enter your Google Account email. Email groups aren't accepted.
4. Choose the permission. Restricted for an audit, Full for an active engagement.
5. Confirm on your side. Check the role you received and add it to your access register.

Access-request email (template)

Replace the curly-brace fields and delete lines for tools the client doesn't use.

TEMPLATE
Subject: Access for your SEO onboarding

Hi {FIRST_NAME},

Please invite {AGENCY_EMAIL} to the tools below. No passwords,
please: each tool has an invite option and you can remove us anytime.

1. Search Console: Settings > Users and permissions > Add user.
   Permission: Full (or Restricted for audit-only).
2. Google Analytics 4: Admin > Property access management.
   Role: Viewer. Add "No Revenue Metrics" if revenue stays private.
3. Business Profile: Business Profile settings > People and access.
   Access: Manager.
4. Tag Manager: Admin > User Management.
   Account: User. Container {CONTAINER}: Read.
5. Website: a named Editor account for {AGENCY_EMAIL}.

We don't need registrar or DNS logins. If a DNS record is ever
needed, we'll send the exact record for your IT contact to add.
We keep a list of every grant and remove them all when we finish.

Thanks,
{YOUR_NAME}

What should the kickoff questionnaire ask?

It should surface what the business earns from, what has already been tried, and what could break. Send it before the kickoff call so the call goes on follow-ups. The answers decide which pages you protect first.

• Goals: which conversion counts and roughly what one is worth.
• Money pages: the 5 to 15 URLs that produce revenue. They lead every scan and report.
• Past SEO work: earlier agencies, bought links, manual actions, traffic drops.
• Migrations: domain, CMS or URL changes, with dates.
• Seasonality: peak and slow months, so a normal dip isn't misread.
• Competitors: the three they lose deals to, not only who ranks above them.
• Brand limits: forbidden claims and who approves copy.
• Who ships changes: you, their developer, or a CMS editor.

What goes into the baseline snapshot week?

Week 2 is for measuring, not fixing. Export search data before it ages out, confirm analytics keeps enough history, crawl the site, and scan key pages plus competitors. The first report needs a dated before-state nobody has touched.

1. Export 16 months of Search Console data. Google says Search Console keeps data for the last 16 months, so older days are gone for good. Report downloads are truncated to 1,000 rows; export in segments, or set up the daily bulk data export to BigQuery for large sites.
2. Check GA4 data retention. In Admin > Data Settings > Data Retention, standard properties choose 2 or 14 months. It affects explorations and funnel reports, not standard reports, and needs the Editor role. If it shows 2 months, ask the client to change it now (see GA4 data retention help).
3. Crawl the site. Record status codes, indexability, canonicals and titles in a dated file.
4. Scan key pages and competitors. A VisRank scan covers the homepage and important pages it discovers across SEO, AEO, Security and Local checks, with separate Trust and Entity and AI Citation evidence. The Full Report adds a PDF export and a competitor score comparison. Scores diagnose page signals; they aren't Google metrics (see the methodology).

What does a 30-day SEO onboarding plan look like?

Split the month into access, baseline, first fixes and first report. Each week ends with something the client can open, so progress is visible before rankings move. Name a real owner per row, especially when the client's developer ships the code.

For Week 3 triage, the client SEO audit template gives each finding a priority, evidence, fix steps and an owner the client can approve.

How do you separate quick wins from strategic work without overpromising?

A quick win is a low-effort fix to a confirmed problem on a page that matters, such as an accidental noindex on a money page. Strategic work covers content, structure and authority, and takes months. Promise fixes and reporting, never rankings.

Write the expectation down. Google's guide to hiring an SEO says no one can guarantee a #1 ranking and tells owners to find someone else if an SEO does. It also reminds owners they are responsible for what hired companies do, so share every change.

What goes in the first monthly SEO report?

The first report compares the dated baseline with the current state, lists what shipped and what is blocked, and sets next priorities. Keep it readable in ten minutes. Show rankings and traffic as context; 30 days is rarely enough to judge them.

• Baseline vs now: Search Console clicks and impressions for money pages, plus rescan results.
• Change log: each fix with date, owner and verification status.
• Blocked items: what waits on the client, and since when.
• Competitors: the same three, measured the same way each month.
• Next 30 days: the top five tasks with owners.

A workable cadence is a weekly check-in during month one, a monthly report after that, and a quarterly strategy review. The client SEO scorecard guide keeps that report consistent. VisRank Monitoring adds change history, score-drop alerts, weekly briefs and comparison for up to three competitors per account; the agency overview lists what each plan includes.

How should you handle offboarding and access hygiene?

Keep an access register from day one: platform, account email, role, who granted it and when. When the engagement ends, request removal of every grant and confirm each one in writing. Clean exits protect the client and your reputation.

• Search Console tokens: removing a verified owner doesn't delete their tokens, so they could re-verify. Remove them under Unused ownership tokens, after checking that Merchant Center or Google Workspace doesn't use the same token.
• Domain verification: the client's own DNS record must stay in place to keep them verified, per Search Console verification help.
• Business Profile: if you were made an owner, confirm the client is primary owner well before you leave.
• CMS and Tag Manager: remove your users and hand over tag notes.

Frequently asked questions about SEO client onboarding

Key takeaways

• Request named invitations at the lowest workable role; never accept shared passwords.
• Leave verified Search Console ownership and primary Business Profile ownership with the client.
• Spend Week 2 measuring: 16 months of Search Console data, GA4 retention, a crawl and a scan.
• Give every week a deliverable and every task a named owner.
• Promise fixes and reporting, not rankings, and write that down.
• Keep an access register so offboarding takes minutes.

Ready to capture the baseline? Run a free VisRank scan of the client's homepage → and save the dated result before the first change goes live.