Key points
- Walk away from anyone who promises a number one spot, a set amount of traffic or a place in ChatGPT answers.
- Paid links that pass ranking credit, private blog networks, doorway pages and mass-made AI pages break Google’s spam policies. Your site carries that risk, not the agency.
- Keep your domain, Search Console, Google Analytics and Google Business Profile in your own name. Give an auditor read access only.
- An SEO firm that offers to write fake reviews or post them for you is selling something US and UK rules now ban.
The clearest SEO red flags are promises nobody can keep, methods the company will not show you, and accounts you do not control. If a seller promises a top ranking, hides how links are built, or sets up your tools in its own name, keep looking. A good SEO company explains its plan in plain words and works in accounts that stay yours.
This guide is for business owners comparing SEO agencies or freelancers, in the US or the UK. Each warning sign is tied to what Google, the FTC or UK law actually says, so you can check it yourself. Near the end you will find questions to ask on a sales call.
Can an SEO company promise a number one ranking?
No, because nobody outside Google decides what ranks. Google’s page about hiring an SEO puts it bluntly: no one can guarantee a #1 ranking on Google. It also warns about SEOs who claim a “special relationship” with Google or offer to “priority submit” your site. If an auditor says their changes will put you in first place, Google’s advice is to find someone else.
Two related claims belong in the same pile. Buying Google Ads does nothing for your free listings, because Google says advertising has no effect on organic results. And a tool’s “Google score” is not Google data. Google’s guidance on third-party SEO tools says they have no access to its internal ranking data and cannot promise performance.
What about promised traffic or a fixed deadline?
A promise of “page one in 90 days” fails for the same reason. Google’s SEO Starter Guide says a change might take effect in a few hours or take several months. It suggests waiting a few weeks before you judge, and notes that some changes make no visible difference.
When a seller does put a number in writing, read the small print. The promise may cover long, rare phrases that few buyers ever type. Ranking for those can be easy and still bring you no customers.
Why should secret methods worry you?
Because you carry the risk, not the agency. Google’s hiring page tells owners to be careful with any company that is secretive or will not clearly explain its plans. It says deceptive content made on your behalf could get your site removed from Google’s index entirely. It also says you are responsible for the actions of any company you hire.
“Proprietary system” is fine as a name for a process. It is not fine as a reason to refuse an answer. Google’s hiring page, updated in June 2026, gives owners a test for this: does the SEO cite official Google documentation to support its advice? The third-party guide adds that good advice either labels a claim as opinion or backs it with official guidance.
Which link building tactics break Google’s rules?
Google’s spam policies define link spam as creating links mainly to manipulate rankings. Examples include paying money for links, trading goods or services for links, and automated link building. Links with optimized anchor text in guest posts or press releases spread across other sites are listed too.
One question sorts most offers. Is money or other value changing hands for a link that passes ranking credit? If yes, it sits inside Google’s examples. Google does accept paid links for advertising when they carry a rel=”sponsored” or rel=”nofollow” tag. A link marked that way is advertising, not a way to buy rankings.
What is a private blog network?
A private blog network, or PBN, is a group of websites one person or firm controls, kept mainly to link to client sites. Google’s policies do not use the term. A network like this still fits Google’s definition of link spam, because its links exist mainly to move rankings. Some networks sit on expired domains bought for their old links, and Google lists expired domain abuse as spam as well.
Read the contract for links too. Google lists a contract that requires a link without letting the site owner label it. It also lists links spread widely through the footers of many sites, such as a “Website by” credit on every client site. In Google’s words on the hiring page, you should never have to link to an SEO.
Ask for a list of every link built for you, with the site and the date. If a seller will not share it, treat that as a warning sign on its own.
What are doorway pages and scaled AI content?
Doorway pages are built to rank for many similar searches and then funnel people to one place. Google’s examples include separate pages for each city that all lead to the same page. One pitch to watch for is “a page for every town you serve” with only the town name swapped.
Scaled content abuse is the same idea at volume. Google’s definition covers making many pages mainly to manipulate rankings, “no matter how it’s created,” and names AI tools used without adding value. AI itself is not banned. The problem is bulk pages that nobody needed. Google’s guide to its generative AI features adds one more case. Making a page for every way someone might phrase a question, mainly to sway rankings or AI answers, breaks the same policy.
What about placing your content on someone else’s big site?
Some sellers offer to publish your content on a strong, unrelated site so it ranks on that site’s reputation. Google’s site reputation policy covers third-party content placed on a host mainly to borrow its ranking signals, and it names white-label services as one source. Outside the European Economic Area, such pages may get a manual action after human review. The US and UK both sit outside the EEA.
Who should own your accounts and your work?
You should. Open every account in your business name, then add the agency as a user. That way you keep your data and history if you part ways.
- Search Console. Google’s permissions help page says every property needs at least one verified owner, and only owners can add or remove users. Make that owner you. For an audit, Google’s hiring page says to give read access only, not write access.
- Google Analytics. The Administrator role has full control, including who else gets in, so keep it in your own Google account. Google’s roles page lists lower roles, such as Editor and Viewer, that suit outside help.
- Google Business Profile. A profile can have several owners but only one primary owner. According to Google’s owners and managers page, managers can edit the profile but cannot add or remove users or delete it.
- Your domain. Register it in your business name, at a registrar where you hold the login. Losing it means losing your web address and any email that runs on it.
- Content, design and code. The contract should say who owns the work you paid for. If the site runs on the agency’s own platform, ask how you would move it.
When you part ways, open Search Console’s Users and permissions page. Removing a verified owner also means removing their verification token from your site, or they may be able to regain access. Google lists leftover tokens under “Unused ownership tokens.”
Which contract terms and reports should make you cautious?
A long contract is not a red flag by itself, since SEO work takes months. The warning sign is a long term with no clear way out. Before you sign, find the notice period, any early exit fee, and whether the deal renews on its own.
Reports need the same care. A weak report is a page of rankings for phrases you have never heard of, or a “visibility score” nobody can explain. Google strongly encourages Search Console as the first-party source, since its data comes straight from Google Search. A useful report starts there, then shows the work done in plain words and the calls, forms or sales you can trace to organic search.
Should an SEO company ever offer you reviews?
Not fake or paid ones. Asking real customers for honest reviews is normal. Fake reviews are banned in both the US and the UK, and so are some kinds of paid reviews.
In the US, the FTC’s Rule on the Use of Consumer Reviews and Testimonials, 16 CFR Part 465, took effect on October 21, 2024. Section 465.2 bars a business from writing, creating or selling reviews that misstate who the reviewer is or what they experienced. The FTC’s announcement lists other banned practices, including buying positive or negative reviews and suppressing bad ones.
In the UK, the Digital Markets, Competition and Consumers Act 2024, Schedule 20, paragraph 13, bans submitting or commissioning fake reviews. It also bans reviews that hide a paid incentive, and offering traders services to do either. Schedule 20 came into force on April 6, 2025. The CMA’s fake reviews guidance gives a banned example that fits this topic exactly. It is an SEO service that promises a better rating when fake reviews are part of the method.
Google’s Maps content policy also bans fake engagement, including reviews paid for directly or in kind. When you check an agency’s own reviews, a mix helps. In its March 2026 update on review cases, the CMA says a 3 or 4 star review is unlikely to be fake. This is general information, not legal advice.
Can anyone promise to get you into ChatGPT or AI Overviews?
No. AI tools choose their own sources for each answer, and no agency controls that choice. Treat “we will get you into ChatGPT” like a promised number one spot.
Google’s guide to its generative AI features says that, from Google Search’s point of view, optimizing for AI answers is still SEO. It says you can ignore “AEO” and “GEO” hacks for Google Search. You do not need llms.txt files, special markup, content cut into small chunks, or text rewritten for AI. It also warns about tools that claim to use internal Google metrics, since no outside tool can see Google’s ranking or AI systems.
ChatGPT works differently, but the same rule holds. OpenAI’s crawler page says sites that block its OAI-SearchBot will not appear in ChatGPT search answers, except as navigation links. It recommends allowing the crawler. The page describes no way to pay for or request a place in answers.
What can be measured is narrow. Search Console’s Generative AI performance report shows impressions: how often links to your site appeared in Google’s AI features, by page, country, date and device. An honest agency can show you those numbers. It cannot promise them.
What does a good SEO company look like instead?
| Red flag | What good looks like instead |
|---|---|
| A package chosen before anyone looked at your site | A plain plan that names real problems on your site, in order, with the reason each comes first |
| Accounts set up in the agency’s name | Access in your name from day one, with the agency as a user |
| A promised date, ranking or traffic number | Honest ranges, plus what could slow things down, like a strong rival or a busy developer |
| Ranking lists and tool scores | Reports tied to your goals, such as calls, forms or sales, and a straight word when something is not working |
| Hidden links and secret methods | Every change and every link shown, with a reason |
| A pitch that never asks about your business | Questions about what makes you different, who your rivals are and how customers find you, as Google’s hiring page suggests |
One more good sign: honesty about whether you need help at all. Google says the owner of a small local business can probably do much of the work themselves, starting with the SEO Starter Guide.
What questions should you ask on an SEO sales call?
Ask every firm on your list the same questions, and write down the answers.
| Ask this | A good answer sounds like | Walk away if you hear |
|---|---|---|
| What would you do in the first three months, and why? | Specific problems found on your site, in order, with a reason for each | A package picked before anyone looked at your site |
| Which accounts do you need, and in whose name? | Your accounts, with the agency added as a user; read-only for the audit | “We set it all up in our account to save time” |
| How do you get links, and can I see them? | Outreach, PR or real partnerships, with a full list you can check at any time | A fixed number of links a month, or “our network” |
| Who writes the content, and who checks it? | Named roles, a human review of every page, and facts checked before publishing | Hundreds of pages a month, written and posted by a tool |
| Do you follow Google Search Essentials, and can you show the guidance behind your advice? | Yes, with links to Google’s documentation, or a clear note that a point is their opinion | “Google told us,” with no source, or a claim of special access |
| What will the monthly report show, and where do the numbers come from? | Search Console, your analytics and your leads, explained in plain words | Rankings only, or a score from their own tool |
| When should I expect to see signs of progress? | A range, what moves first, and what could slow it down | A date or a traffic figure promised in writing |
| How long is the contract, and how do I end it? | A clear notice period, with accounts, content and the link list handed back | A long term, automatic renewal, or a fee to get your own data |
| Will you ever write, buy or post reviews for us? | No, though they may help you ask real customers | A review package, or “we have people who can post” |
| What can you do about AI search like ChatGPT? | The same SEO work, plus tracking AI impressions where Google reports them | A promised mention in ChatGPT or AI Overviews |
Before you sign, check that you have these in hand:
- A written plan for your site, not a general package.
- Owner or admin rights to your domain, Search Console, Analytics and Business Profile.
- A contract with a notice period and a list of what is handed back.
- A sample report you can read without help.
- A written answer that the firm will not buy reviews, or links that pass ranking credit.
Where can you report a dishonest SEO company?
Google’s hiring page points US owners to the Federal Trade Commission, which handles complaints about deceptive or unfair business practices. You can file one at ReportFraud.ftc.gov. For a company based in another country, Google points to econsumer.gov.
How ECL can help
If you want a second opinion before you sign with anyone, Ecommerce Linkers offers a free SEO audit. We only need read access to your Search Console for it, and you get your first three fixes in plain words. We make no promises of rankings, traffic or AI mentions. We do no work against Google’s policies, and any link we build is yours to see on request.
Our ongoing plans include a monthly report. If you stop, we ask for one month’s notice, and your analytics, Search Console, content and other assets remain yours. See how ECL runs the work on our SEO services page.
