SEO red flags: how to spot a dodgy SEO provider before you pay

The biggest SEO agency red flags are promises nobody can control and work you can't verify. Ask for dated evidence and check it against your own accounts. Slow results alone don't prove misconduct. A serious ownership or security problem needs prompt attention, whatever the results look like.

Separate a warning sign from proof

Not every concern means the same thing. Some need action today. Others need a written explanation, or simply time.

This is editorial triage, not a legal finding or a validated risk score.

One severe issue can justify prompt action. That holds even when every other answer looks fine. Think unauthorised changes, a false claim of Google affiliation or losing control of an account. A tally of mild concerns can matter less than one of those.

Mild concerns still deserve a dated note, with a time to revisit them. A common mistake is scoring a checklist instead of weighing how serious each issue is.

These aren't proof of dishonesty on their own:

• a cheap quote

• an overseas contractor

• agency managed hosting

• one disappointing month

Equally, a polished report or a confident explanation isn't proof of work. The useful question is what you can verify independently. Then decide what follows. Our broader guide to SEO for small business puts these checks in context.

The 10 biggest SEO red flags

Each flag below comes with a fair qualification and one way to check it. Several involve black hat SEO. That means methods meant to manipulate rankings in breach of search policies.

Paid links should carry a label, such as sponsored, that tells Google they were paid for. Match your response to the answer. A vague reply about scope or reporting calls for a written follow up. An evasive answer about control, security or affiliation calls for faster action.

A fair scope is easier to judge once you know what SEO deliverables include.

Treat ranking guarantees and affiliation claims carefully

Google says no one can guarantee a number one ranking in Google. Organic results are the unpaid listings. Nobody outside Google controls them. A delivery commitment is a different thing. Ask which queries, locations and result types are promised.

This is example teaching wording. Any real commitment has to match the actual service agreement.

Check badges too, because a Google Partner badge relates to advertising partnerships, not organic SEO. Google's badge rules say the badge can't appear on materials advertising SEO without a prominent notice. The notice must say those services aren't verified or endorsed by Google. A real badge should link to the company's public Partner profile, so click it.

A claimed special Google relationship deserves scrutiny. So does paid priority in organic results, or a guaranteed AI recommendation.

Google's third party policy tells partners not to claim a special Google relationship. They can't guarantee top organic placement either. A provider outside that policy isn't bound by it. The claim is still a warning sign.

Check the price against the promised work

Price alone tells you little. A narrow maintenance service, strategic advice and full implementation are different purchases. Whatever the fee, ask:

• what the output limits are

• what's excluded

• who implements the changes

• how work is reviewed before it ships

A big promise at a small price deserves the most questions. Scope drives price, so compare quotes with what SEO costs for similar work.

Some tactics need evidence before you accept them:

• made up audit findings or false penalty scares

• claims of a special Google affiliation

• undisclosed paid links or link networks

• doorway pages, thin pages built to catch each suburb search

• low value content published at scale

• review gating, meaning only asking happy customers for reviews

• lead generation sites competing for your customers

Google's spam policies cover link spam, doorway abuse and scaled content made mainly to manipulate rankings. Using AI, or publishing a lot, doesn't prove abuse by itself. Judge the purpose and the substance. Review collection rules explain why gating causes trouble.

Several sites under one owner isn't link spam by itself. What matters is whether links exist mainly to manipulate rankings.

If a provider runs lead generation sites in your market, ask who gets those leads. Ask about routing, exclusivity and who owns the sites too. Don't assume your retainer funds them without evidence. Outsourced work needs accountable quality review, with disclosure that matches what was sold.

Ask for a dated record of work

Before judging delayed outcomes, make the work visible. Ask for a record of each piece of work:

An audit recommendation isn't a shipped fix. An invoice isn't proof of implementation either.

A plan often runs in stages:

• early work covers access, a baseline (your starting numbers) and priorities

• later work implements fixes and useful pages

• then the outcome is reviewed and the plan revised

Match this to your actual contract. Nobody can promise ranking movement by a set month.

Ask what stopped progress. Missing approvals, limited developer time or broken tracking can all matter. Record each blocker, who owns it and the next date. That separates poor communication from absent delivery, though neither should run on forever. Ask for the work log monthly, so gaps show up early rather than at renewal.

A legitimate month can include research and outreach. It can even include experiments that failed, if their purpose and output are clear. Don't demand a cosmetic website change every month to prove activity. A repeated report template is normal. Repeated commentary with nothing behind it is a reason to ask questions.

Check what any growth claim is measured against. A 400% increase from 50 visits means 250 visits. That says nothing about profitable enquiries on its own.

Read the report and the explanation together

A report and the explanation around it are one piece of evidence. Ask for these parts:

Measuring SEO returns explains how to define the outcomes.

This is an example. A percentage needs a baseline and a consistent method. Where the data allows, separate searches for your brand from everything else. Ask for metric definitions and exclusions in writing, so next month uses the same rules. An apparent improvement can come from changing:

• the keyword set

• the country or device

• the date range

• the attribution rule, meaning how results are credited

Here's an example. Say the last comparable period had 20 enquiries and this one has 26. That's six more, or 30%. But suppose six current enquiries are duplicates or spam, and none were removed last time. Clean both periods the same way and it's 20 against 20, with no growth at all.

Don't clean only the period that tells the better story. Common explanations deserve evidence too:

A coincident algorithm update doesn't prove cause. Check a claimed update before accepting it, using Google algorithm updates. A common mistake is accepting "algorithm update" as the whole explanation.

A traffic increase can be irrelevant. Flat enquiries can reflect capacity, conversion or tracking issues rather than missing SEO work. If that's the pattern, start with our guide to diagnosing traffic without enquiries. Ask what observation would change the plan.

Check technical claims without guessing

Start by naming the exact claim. Most checks happen in Search Console, Google's free tool for site owners. Indexed means Google has stored a page and can show it in results. Each claim type has its own evidence:

Use the right property, meaning the version of your site you've verified. New to the reports? Start with Google Search Console.

A manual action means a human reviewer found pages breaking Google's spam policies. A clean report means no manual action is reported for that property right now. It doesn't rule out automated spam detection, technical faults or relevance problems. Security issues sit in a separate report. For a wider diagnosis, follow Google's traffic drop guidance.

Typing site: followed by your domain into Google can surface unexpected pages. Google says it doesn't necessarily return every indexed URL. A missing page isn't proof of removal. Use URL Inspection, a Search Console tool, for the actual URL.

Check backlinks and disavow advice

Backlinks are links from other websites to yours. Ask for the provider's record of placements. Compare a sample with the actual pages and with Search Console.

The Links report shows only a sample, including links found in the past. Its latest links export is sorted by discovery date. That isn't necessarily when a link was published or bought.

Check relevance, editorial context and how each link was arranged. A burst of links can follow legitimate publicity. Quiet months can hold good work. A common mistake is reading a sudden link spike as proof of bought links.

Disavowing tells Google to ignore certain links. Google says most sites won't need its disavow tool. It's for a considerable number of spammy links that caused, or likely will cause, a manual action. Used incorrectly, it can harm performance.

A toxicity score from a third party tool isn't enough. Neither is an arbitrary share of unattractive domains.

Four modest checks make a useful first pass:

• inspect a few claimed changes on the live site

• read recent content for business accuracy

• open a few claimed link placements

• reconcile one report figure with its source

It's a first pass, not a full audit. For a full audit, work through the SEO audit checklist.

Confirm access, ownership and exit terms

Control, ownership and licensed access are different things. Record each platform like this, without passwords or recovery codes. Keep the finished record somewhere the provider can't edit:

For a .au domain, the registrant is the entity holding the domain name licence. The WHOIS guide from auDA explains how to check who that is. Paying an invoice or holding a hosting login doesn't make you the registrant. Changes go through the registrar, the company the domain was registered through. Don't try to move a disputed domain outside that process.

IP Australia says IP created by a contractor belongs to the contractor, unless the contract says otherwise. So buying a service doesn't automatically transfer every underlying right. Check the agreement's assignment or licence terms, payment conditions and treatment of existing materials.

Managed hosting and shared agency tools can be legitimate. You should understand your usable rights, export options and transfer costs. You may not be entitled to an admin account covering other clients. Ask for access specific to your business instead.

Check your access to the platforms that matter:

• Search Console and Analytics

• your Business Profile and content management system (CMS)

• DNS, which points your domain at services, and hosting

• ad accounts and call tracking

Use individual accounts with suitable roles. Keep recovery details under business control. Never email a list of passwords. Don't give an unsolicited auditor unrestricted access either. For profile ownership and roles, see our Google Business Profile guide.

Read these clauses closely:

• renewal and notice

• cancellation charges

• variation and minimum spend

• subcontracting and exclusivity

• handover

A difficult clause is a reason to get advice, not an automatic legal conclusion. Notice wording is easy to misread.

These are example clauses. The first usually lets you give notice earlier, subject to its exact terms. It doesn't by itself limit you to one week. The second creates a window of roughly 30 days. Check the exact dates, business day rules and how notice must be served.

Understand Australian protections

Three separate legal routes can apply:

• misleading conduct in trade or commerce

• unfair terms in a qualifying standard form contract

• consumer guarantees, where the purchase qualifies

Misleading conduct covers false or misleading claims in trade. The ACCC says a business must be able to prove any claim it advertises. A missed commercial goal isn't misleading conduct by itself. Nor does it guarantee a full refund.

The ACCC says the changes took effect on 9 November 2023. Proposing, using or relying on unfair terms in a covered standard form contract is now banned, with penalties. A standard form contract is one offered without real negotiation. Small businesses with fewer than 100 employees or under $10 million in annual turnover are covered.

The changes apply to contracts made or renewed from that date, and to terms varied or added since. So older agreements aren't all treated the same way. Unfairness needs all three of these:

• a significant imbalance in the parties' rights and obligations

• it isn't reasonably necessary to protect the advantaged party's legitimate interests

• harm to the other party if the term were relied on

A court also considers transparency, reading the contract as a whole. Only courts make the final call. One sided renewal wording is a prompt for scrutiny, not a verdict an SEO checklist can deliver.

Some business purchases also get consumer guarantees. The ACCC says that includes services costing less than $100,000 including GST, with some exceptions. For services, the guarantees require acceptable care and skill. Services must also be fit for any stated purpose. Where no time was agreed, they must be supplied within a reasonable time.

Have a qualified adviser assess the actual purchase and remedy. Disappointing rankings don't guarantee cancellation. Don't withhold payment as a tactic, make threats or accuse anyone publicly.

The ACCC uses reports to inform its compliance and enforcement work. It doesn't resolve individual disputes. For a dispute, a written complaint to the provider is a sensible first step. The small business ombudsman, ASBFEO, can arrange dispute resolution where appropriate. State small business commissioners can help too.

Learn from two ACCC examples

These examples involve advertising and website services. They don't prove any unnamed SEO provider broke the law.

In May 2017, the ACCC accepted a court enforceable undertaking from Sensis. That's a formal promise a court can enforce. The concern was automatic renewal and cancellation of bundled directory and online packages.

Sensis agreed to refund affected customers, disclose renewal terms more clearly and change its contract terms. The undertaking wasn't a court penalty. It also came before the 2023 regime.

In January 2024, Dreamscape Networks paid $56,340 under three infringement notices. The ACCC alleged that "free" products on the Crazy Domains website renewed with fees that weren't clearly disclosed. It also alleged misleading Domain Privacy claims. Paying an infringement notice isn't an admission or a court finding. The lesson is to check renewal costs and what a service actually does for you.

Estimate the cost without inventing losses

Here's an example scenario, in Australian dollars excluding GST. An owner pays $800 a month for 14 months. Then they get a quote of $4,000 to $6,000 to fix the problems.

The midpoint only illustrates the waterfall. The full range runs from $15,200 to $17,200:

A remediation allowance is a planning amount until it's spent. Some earlier work may still have value. Keep these separate:

• fees already spent

• necessary remediation

• transition costs

• any refunds or credits

• unmeasured opportunity cost, meaning what you might have earned otherwise

Lost enquiries or profit need a defensible comparison and real business evidence. We've deliberately left them out of the numbers here. Compare the cost of checking and fixing with the cost of carrying on unexamined.

Respond to a concern in writing

Start by preserving the record. Keep the original, dated versions of:

• the proposal and agreement

• invoices

• reports and approved changes

• relevant correspondence

Redact personal or confidential details before sharing anything with an independent reviewer. Vendor access to customer data should match your website privacy and terms.

Then ask about the specific discrepancy in writing:

This is a factual request, not a legal demand. A reasonable date depends on the issue and the agreement. Asking for the last 90 days of completed actions is a sensible start.

Agree a second opinion's scope and deliverables in writing. Google recommends giving only read access to Search Console if an SEO offers to audit your site. Agree any permission to make changes separately, once you've seen the findings. Verify who's contacting you through a channel you already trust. Never install unknown scripts or grant owner access because a cold email claims a penalty.

If the evidence resolves the concern, document a clearer plan. If gaps remain, get an independent assessment and review your contract options. If there's an immediate security or operational threat, involve your technical owner now. Preserve the evidence while you do.

Keep the dispute private until you've had advice on any public statement.

Leave safely and prioritise recovery

Confirm the agreement and practical dependencies before serving notice the required way. Make sure you have current website backups. Export the records you need too. Then arrange an authorised handover of accounts, licences and files.

Before removing anyone's access, check what depends on them:

• the domain, DNS and email

• forms and booking integrations

• call tracking numbers and ad billing

• third party licences and scheduled publishing

A report export isn't an account transfer. An unchanged website can still depend on a provider's paid licence. Change passwords and remove access only once continuity is confirmed. Tell your team which accounts are changing, so nobody gets locked out by accident. A common mistake is removing the old provider's access before checking what depends on it.

For the technical side, follow transferring a website.

Don't delete old content, abandon useful URLs or disavow a whole link profile as a fresh start. Audit what works and keep valuable assets. Changing providers doesn't require a new domain or platform. If the site is genuinely moving, use the website migration SEO checklist.

The same windows as a plan:

These are work windows, not a recovery forecast. Manual action reviews, recrawling and competition all affect timing. For realistic expectations, read how long SEO takes.

Use this severity check at any stage:

What we recommend at Elev8d

Frequently asked questions

Next steps

Written by Ajay K.Co-founder, Elev8d

Ajay is the co-founder of Elev8d and writes most of what you will read here. Psychology grad turned marketer, which is a fancy way of saying he cares about why people click, not just where things rank. Every guide is written in plain English for Australian businesses, tested on real campaigns before it earns a spot on this site.