Ethical SEO means improving discoverability without deception, hidden commercial arrangements or claims nobody can substantiate. Before hiring an agency, inspect its methods, evidence, access requirements and exit terms. Choose a provider that explains uncertainty and accepts accountable approvals—not one promising a guaranteed ranking or an “AI-certified” shortcut.
Editorial review: . This is a buyer’s due-diligence framework, not an agency certification, a finding about any named provider or legal advice.
1. Separate trustworthy methods from a service list
A proposal may include an audit, content and reporting while leaving its actual methods unexplained. This guide answers “Can I trust the provider and control the risk?” For “What should I receive?”, use the separate SEO services, scope and deliverables guide. Both questions matter, but a long list of deliverables does not resolve concerns about undisclosed tactics.
Learn enough of the SEO basics to ask what a proposed change does. Ask the provider to show one recommendation, the evidence behind it, who implements it, how it will be tested and how it can be reversed. A competent explanation should distinguish an observed problem from a hypothesis.
Google explicitly warns that no one can guarantee a number-one ranking on Google.[1] A provider can commit to work within its control—such as a review date or an approved implementation—not to a search engine’s decision.
Ask for references with permission and examples that explain the starting conditions, dates, scope and limitations. A traffic screenshot alone does not establish causation, qualified leads or profit. If confidentiality prevents sharing client details, request an anonymized walkthrough with its limits stated; do not pressure the agency to breach another client’s trust.
2. Use a question, evidence, red-flag and action table
Use the same questions with every shortlisted provider. Mark unanswered items as unresolved rather than assuming the best or treating silence as proof of wrongdoing.
Download the editable agency-vetting CSV. Record the respondent, date, evidence location, approval owner and follow-up deadline. Keep confidential proposals and access details out of public worksheets.
| Question to ask | Evidence to request | Red flag | Your next action |
|---|---|---|---|
| What will you change, and why? | A sample recommendation with diagnosis, implementation steps and verification. | Methods are “secret” even from the client. | Pause approval until the method and risks are explained in writing. |
| Who owns accounts and work? | An access matrix and contract terms covering domain, hosting, analytics, content and licenses. | The agency is the sole owner of essential accounts. | Require business-controlled ownership and named, revocable agency access. |
| How are links obtained? | Example placements, payment disclosure and the planned link attributes. | Guaranteed followed links sold primarily to influence rankings. | Reject the tactic unless it is changed to a clearly explained, acceptable arrangement. |
| Who approves high-impact changes? | A workflow for redirects, deletion, robots rules and content claims, with backups. | Unrestricted production changes with no change log or rollback. | Set approval thresholds and test a small, reversible release first. |
| How is success reported? | A sample report linking shipped work to comparable search data and qualified outcomes. | Only proprietary scores, selected screenshots or unqualified traffic totals. | Agree definitions and access to underlying evidence before signing. |
| What does your AI promise mean? | Named platforms, exact claims, observation method and written limitations. | Guaranteed inclusion or citation sold as controlled by the agency. | Remove the guarantee; require a repeatable measurement plan. |
| What happens when we leave? | A handover list, notice period, final export format and ownership terms. | Hidden exit fees or loss of the domain, content or reporting history. | Resolve terms before payment; obtain legal review where appropriate. |
3. Examine paid links, automation and AI guarantees
Paid promotion is not the same as buying ranking credit
Ask whether money, products or services change hands for a link, who chooses the placement, whether the relationship is disclosed and how the link is qualified. Google lists buying or selling links for ranking purposes as link spam. Its policy allows advertising and sponsorship links when qualified with rel="nofollow" or rel="sponsored".[2] Local advertising-law obligations are a separate question.
A blanket promise of a fixed number of “high-authority dofollow links” deserves scrutiny. A third-party authority score is not Google’s approval, and an agency should explain what it can control. Ask for placement approval and a record of payments. Do not accept “everyone does it” as a risk assessment.
Policy violations can result in reduced visibility or exclusion from results; Google’s policies also describe automated detection and possible manual actions.[2] That is a risk, not proof that a tactic always causes a ban, or that a drop will happen after a fixed number of days.
AI tools do not transfer accountability
Ask who checks generated facts, sources, copyright permissions, sensitive information and customer-facing claims. Request a sample review trail and a correction process. “AI-assisted” does not explain the quality of the finished work; a human sign-off should name the reviewer and scope of the check.
For Google AI Overviews and AI Mode, Google says there are no additional technical requirements or special optimizations, and eligibility does not guarantee inclusion.[3] A guarantee covering every AI product is even less meaningful without precise, testable terms. Ask which product, country, prompt and date are being observed.
Use the AI-search citation measurement guide to distinguish a brand mention, linked citation, referral visit and qualified outcome. A citation does not establish a commercial endorsement or revenue.
4. Keep ownership, approvals and an exit route
Your business should control the domain registration, essential hosting and primary analytics/search accounts. Invite named agency users with the minimum permissions needed. Do not email a shared administrator password; use a suitable invitation or secure access process, and retain a recovery route independent of the provider.
Agree which actions need explicit approval: publishing claims, purchasing placements, deleting pages, changing redirects or crawl/indexing rules, and installing tools with broad access. Require a dated change log, a backup and a rollback owner. For troubleshooting, ask for the evidence-and-verification pattern in the SEO mistakes diagnosis guide, not an unexplained “health score.”
Before signing, define handover timing, editable source files, account access, reporting exports and the treatment of paid software or licensed assets. Specify any cancellation charges and which assets cannot transfer. At exit, verify handover before revoking access; then remove unneeded users, tokens and integrations. Contract wording may need a lawyer familiar with your jurisdiction.
5. Check specific warning signs
Select only signs you have actually observed. This is a follow-up checklist, not a numerical trust score, certification or verdict. One serious unresolved issue may matter more than several minor concerns; an unchecked list proves nothing.
For each selected sign, save the exact wording, request a written correction or explanation, and assign a follow-up owner. Pause the affected purchase or access grant while a serious issue remains unresolved. If the response cannot address the concern, compare another provider.
6. Copy this evidence-request email
Subject: Evidence and access questions before SEO approval
Thank you for the proposal. Before we approve it, please send:
- One sample recommendation showing the evidence, implementer, approver and verification method.
- Your link-acquisition methods, any placement payments and the proposed link attributes.
- An account-access and ownership list, including what remains under our business’s control.
- A sample report with metric definitions and the limitations of any ranking or AI-visibility claims.
- Your production-change approval, rollback, cancellation and handover process, including fees and non-transferable licenses.
Please identify assumptions, exclusions and guarantees explicitly. Our approval contact is [name]; please reply by [date]. We will review unresolved risks before granting access or authorizing the affected work.
After the reply, compare the evidence with the contract and statement of work. Promises in a sales call should not contradict the written agreement. Start only when the people responsible for approvals understand what they are authorizing.
Primary sources and limitations
Google’s documentation supports the specific policy and eligibility statements below. The worksheet and contract questions are editorial due-diligence recommendations; they cannot establish a provider’s trustworthiness or replace legal advice.
Watch: Google’s advice on hiring an SEO
Google Search Central’s Maile Ohye explains how to evaluate an SEO provider. This 2017 video is background on hiring principles, not a current walkthrough of Search Console or AI products. Loading it connects to YouTube; use the written checklist above if you prefer not to load third-party media.