Before You Hire a Shopify SEO Agency: Get These Ready

Quick answer: Before you hire a Shopify SEO agency, get five things ready: ownership of your Search Console property and an Administrator role in GA4, so the agency gets a role and never the keys; a plan for Shopify access that uses staff or collaborator accounts and never your owner login or a shared password; your margin and stock position for the products worth pushing; one business goal with a baseline number; and one named person who approves content and theme changes. Having these ready should mean the first weeks go on findings, not on chasing logins.

This list is written from your side of the table. It covers what you should own, what you should share and how, and the things an agency cannot work out without you: which products are worth selling more of, what you are trying to achieve, and who says yes.

I am Talha, and in the free diagnostic I review GA4 and a Shopify store together. These are the gaps I would check first: a Search Console property nobody can verify, GA4 held by a login that left the business, a plan with no room for a staff account, a goal of “more traffic”, and nobody to approve a blog post. If you are still choosing, how to choose a Shopify SEO agency in Australia covers the buying side.

The Google and Shopify settings below were checked against the official help pages on 30 October 2026. Labels and limits change, so confirm them in your own admin.

The checklist at a glance

If you only have an hour, do the first, second and sixth rows.

1. Search Console: you own it, the agency gets a role

Search Console is where Google reports how your store appears in search. An agency cannot audit indexing without it.

Check which property you have

A Domain property includes all subdomains and multiple protocols, and it can only be verified with a DNS record. A URL-prefix property includes only URLs that begin with the exact prefix you entered, protocol included, and it can be verified in several ways (Google’s Search Console help on adding a property). Open Search Console and note which type you have. If you have none, add one today.

“Today” matters. Google says data collection starts as soon as anyone adds a property, and that data should begin to appear in a few days. Search Console keeps the last 16 months of data (Google Analytics Help, Queries report page). Google does not say it fills in the time before a property was added, so do not count on it: the sooner the property exists, the more history an agency has to judge a baseline against.

Know the roles, then give the agency the right one

Google’s help page defines them like this:

• Owner (verified): someone who proved ownership with a token, such as an HTML file or DNS record.
• Owner (delegated): someone a verified owner granted ownership to, without a token.
• Full user: view rights to all data, and can take some actions.
• Restricted user: simple view rights on most data.
• Associate: a person or account that can take certain actions for your site or access certain data, but cannot open Search Console directly.

My rule: you are the verified owner, and the agency is a full user. Only an owner can add or remove users, so you stay in control. To add someone, open the property, go to Settings, then Users and permissions, click Add user, enter their Google Account email and choose the permission. Google says email groups cannot be added.

Check who else is an owner

Several people can verify ownership of one property. Two checks:

1. Old owners. If a previous freelancer or agency verified ownership, check whether they are still an owner. Google says you can unverify a previous owner by removing their verification token, such as the HTML tag they added to your site, and that a removed owner can re-verify for as long as their token remains.
2. Your safety net. Google says that if all verified owners lose access, all users lose access, and that you should not remove a DNS verification record after verifying. Make sure the method belongs to something you control.

If you have access to your theme or DNS, you can verify the property yourself with your own token. If you cannot verify, Google’s advice is to ask a current owner to grant you access.

Then save the baseline: a screenshot of clicks and impressions over the longest date range available, plus top pages and queries.

2. GA4: Administrator for you, a narrower role for them

GA4 holds your sessions, conversions and revenue by source. For SEO it answers one question: is organic search bringing orders, and which pages bring them?

Roles in plain language

Google’s access management page lists these roles (as at 30 October 2026):

• Administrator: full control, including adding and removing users.
• Editor: full control of property settings, but cannot manage users.
• Marketer: can create, edit and delete audiences, events and key events.
• Analyst: can share explorations with other users of the property.
• Viewer: can see settings and data, and change which data appears in reports.

To add someone, go to Admin, then Property access management (or Account access management for the account level). You must be an Administrator to do it.

For an SEO engagement I would start the agency at Viewer or Analyst, and give Editor only when a change to measurement is agreed. Keep Administrator for people at your business, and check the list of who already holds it. If a former employee or an old agency does, you want to know before you add anyone new.

Google also offers No Cost Metrics and No Revenue Metrics restrictions. Hiding cost is fine; do not hide revenue, or an agency cannot tie its work to revenue by page and channel.

Set data retention before you need it

Google’s data retention page says the setting only affects explorations and funnel reports, not standard aggregated reports. For a standard property you can choose 2 months or 14 months, and you need the Editor role to change it (Admin, then Data Settings, then Data Retention). If anyone will use explorations to look back, 14 months is the longer option. It is a quick change, so make it before the agency starts.

Link Search Console to GA4

Google says linking them needs the Editor role on the GA4 property and verified-owner status in Search Console, and it adds two organic search reports to GA4. Do it before the agency arrives, while one person holds both roles.

Check that purchases are counted properly

Pick a recent week and compare orders in Shopify admin with GA4 purchases for the same week and time zone. A small gap is normal because the two tools count differently. A large or unexplained gap means one of them is wrong, and an SEO report built on it will be wrong too. GA4 and Shopify Analytics explains why the counts differ.

3. Shopify access: least privilege, never your owner login

Never share your Shopify owner login, and never send a password to anyone, an agency included. Create a separate account for each person, with the narrowest role that does the job. You can then see who is on the store, remove one person without touching anyone else, and your own account stays yours. Shopify’s design points the same way: two-step authentication is set up per individual account, and Shopify says the store owner cannot turn it on for another staff member. A shared login blurs whose account it is, and a password sent in a message stays in that message.

Check whether your plan allows a staff login

Shopify’s page on user limits (as at 30 October 2026) lists the maximum user accounts by plan: Starter and Basic 0, Grow 5, Advanced 15, Plus unlimited. It says the 0-user limit on Basic and Starter applies to staff accounts only, and that collaborator accounts do not count towards any limit. It says you can grant access to “Shopify Partners or other freelancers” with collaborator accounts.

So there are two routes:

• Staff account. Add the person under Settings, then Users, with their email address and a role. Invitations to create a staff login expire in 7 days, so send it when they are ready.
• Collaborator account. Generate a 4-digit request code under Settings, Users, then Security, and give it to the person. They submit a request, Shopify emails you, and before accepting you can review and edit the role it generates. Shopify requires partners to use two-step authentication, a collaborator who has not logged in for 90 days loses access, and collaborators cannot take over store ownership.

On Basic or Starter, ask any agency early how it works with that. Do not solve it by handing over your own login.

Build the role for the job

Shopify’s permission descriptions (as at 30 October 2026) let you be specific. The ones an SEO engagement usually touches:

• Products: view, or create and edit (create, edit, import, publish, share and archive products and collections). Shopify says the view permission does not let a user see product costs, and create and edit does not let them edit cost or price. Those are separate permissions.
• Blog posts and pages: view, create, change, publish and delete.
• Menus (under Content): view, create, change and delete navigation.
• Themes: view, change and publish any theme in the Draft themes section, plus access to the command line tool. A separate Edit code permission covers the code editor.
• Reports: view and create reports, which include sales information and other store data. Treat this one as optional, because GA4 already gives an agency the traffic and conversion view.

For an audit, the agency usually needs very little: read access to products and content. When changes begin, add create-and-edit on the content types being changed, and Themes or Edit code only if someone will change theme files.

In my view (Shopify’s page does not cover SEO roles), an SEO engagement does not need orders, customers, finance or billing. Shopify marks some of those as sensitive, including customer data requests, tax documents and payment settings. Leave them out. Because the cost-view permission is separate, you can give product access without revealing costs, and share margins another way (section 5).

Treat theme work as a handover

The Themes permission includes publishing, so “we will check before it goes live” is an agreement between people, not a lock. Write it down, and make it hard to break by working on a copy:

1. Duplicate the live theme and make changes on the duplicate. Shopify says a backup copy lets you discard changes. (If you already have 20 themes, delete one first.)
2. Share a preview link of the unpublished theme. Shopify says you can share a preview of an unpublished theme, not of your published one.
3. You, or the person you name, press publish.

What a normal request looks like

A staff or collaborator account, a Search Console user role and a GA4 Viewer role is normal. Your owner login, a password, or your own Google account “just to be quick” is not. Shopify SEO agency red flags has more. We ask for access too, and we do not run engagements without measurement infrastructure. But it comes through your own admin, one role at a time. What a Shopify SEO service includes lists the work access is for, so you can ask what any request is for.

4. Developers, apps and recent changes

An agency can only work well on a theme if it knows who else is working on it. Write down:

• Who else edits the theme. A freelancer, a retained developer, an app that injects code. Two people editing the same files unknowingly can overwrite each other’s fixes.
• Any change freeze. Black Friday is Friday 27 November 2026, and our Black Friday checklist suggests freezing the theme about a week before. That puts the freeze around Friday 20 November, so agree now which changes can ship before it and which wait until after the sale.
• Installed apps and what each is for. Many add scripts or URLs.
• Recent big changes. A migration, a theme change, a new domain, bulk URL edits, a pile of redirects. These often explain traffic movements.
• What the last agency did. Ask for a written list of changes to titles, redirects, links and content. If you are leaving one, what to do when a Shopify SEO agency is not delivering covers the exit.

5. Margin and stock capacity: what an agency cannot see

Agencies see rankings and traffic. They cannot see which products make money and which you can supply, and a good plan needs both.

Give margin as bands, not costs

For each top product or collection, note gross margin after product cost, freight and payment fees as a band: high, medium or low. You do not need to share exact costs. Here is why it matters, as an illustration. The figures are made up for the arithmetic and are not from any real store.

Over 100 orders, A leaves $2,800 and B leaves $3,100. B has the lower price and the higher gross profit, so a page that wins one more order of B is worth more than one more order of A.

Give stock depth and lead time

For your top products, note how much stock you hold and how long a restock takes. SEO does not move in days (see how long Shopify SEO takes), so a product that often sells out, or has a long supply gap, is a poor place to build a page.

Put both into a short list: push (good margin, reliable stock), hold (poor margin or supply risk) and fix first (good margin, but the page, price or stock needs work).

6. One business goal, written as a sentence

“More traffic” is not a goal. Neither is “rank number one”, and no honest agency can promise a position. You need one sentence a report can prove or disprove:

Grow [measure] from [baseline] to [target] by [date], measured in [tool].

Pick the measure that matches your problem:

Two rules for the sentence:

1. It has a baseline. Use your last full 90 days, and the same period last year if you have it. Three numbers Shopify founders watch helps you choose.
2. It does not depend on a promise. Agree what you will review at each checkpoint, not a figure someone “guarantees”. Give it a window long enough to mean something, because SEO takes time.

If you cannot choose between two goals, choose the one tied to profit.

7. Who approves content and changes

Work stalls when nobody can say yes. Settle this before the first piece of work:

• One name with authority over product facts, claims and tone, plus a backup for holidays.
• A turnaround time. Without one, “pending approval” becomes the default status.
• A list of what needs sign-off. Product claims, anything on health, safety or ingredients, prices and offers, and changes to your homepage or navigation are the usual ones. Routine changes can be pre-agreed.
• A way to see work before it is live. Shopify says blog posts are hidden by default and not displayed on your store until you publish them, and you can schedule a post’s visibility for a set date. For theme changes, use the preview link above.

What to send in your first message

Paste this and fill the gaps:

1. Store address and plan.
2. Who holds Search Console ownership and GA4 Administrator.
3. Your goal sentence with its baseline, and your push, hold and fix-first lists.
4. Who else edits the theme, any freeze dates, and what the last agency did.
5. Your approver’s name and turnaround time.
6. Your budget range, and retainer or project (what drives Shopify SEO cost helps).

Do not include passwords, ever.

Ready to send it? Tell us about your store.

Offboarding: take the access back

The last job is the one people forget. When an engagement ends:

• Search Console: open Users and permissions and remove access. Google says a removed owner can re-verify while their verification token remains, so also remove any tokens they added.
• GA4: remove them in Property access management and Account access management.
• Shopify: remove the staff account, or remove the collaborator. Shopify says collaborator access expires after 90 days without a login, but removing it yourself does not wait.
• Apps and scripts: check for apps or code they added, and ask for a list.

Key takeaways

• Own Search Console as a verified owner and hold Administrator in GA4. Give the agency a role, not the keys.
• Add Search Console today if you have no property: collection starts when it is added.
• Never share your Shopify owner login or any password. Use a staff or collaborator account with a role built for the job.
• As at 30 October 2026, Shopify lists 0 staff accounts on Basic and Starter, and collaborator accounts do not count towards user limits.
• The Themes permission includes publishing, so work on a duplicate theme and agree who presses publish.
• Give margin as bands and stock as depth, so effort goes to products worth selling.
• Write one goal with a baseline, a target, a date and a tool. Name one approver and take access back when the work ends.

FAQs

What access does a Shopify SEO agency need?

Typically a Search Console user role, a GA4 Viewer or Analyst role, and a Shopify staff or collaborator account with a role built for the work. For an audit that is mostly read access to products, content and reports. In my view, orders, customers and finance are not needed for SEO, and Shopify flags some of them as sensitive.

Should I give my Shopify login to an SEO agency?

No. Never share your owner login or a password with anyone. Shopify lets you add a separate account for each person with its own role, and its two-step authentication is set up per account. An agency that insists on your own login is a red flag.

Can I hire an SEO agency if I am on Shopify Basic?

Usually, but access works differently. As at 30 October 2026, Shopify lists 0 staff accounts for Basic and Starter, while collaborator accounts do not count towards user limits. Ask the agency which route it uses, and do not hand over your own login to get around it.

What if my previous agency owns my Search Console or GA4?

Ask them to add you as an owner in Search Console and as an Administrator in GA4, then remove themselves once you are in. For Search Console, Google says several owners can verify the same property and that you can unverify a previous owner by removing their token. If you cannot get in, verify the property yourself and collect data under your own control.

Should I know my budget before talking to an agency?

Yes: a range, and whether you want a retainer or a one-off project. What drives Shopify SEO cost explains the main factors.

Want a second pair of eyes on your store?

Our Shopify SEO service includes a technical audit covering crawlability and indexation, which is the work this access is for. Every plan starts with the free diagnostic: tell us about your store or book a free 30-minute diagnostic. We look at your store before we recommend anything, and we tell you honestly if SEO isn’t the right move. No pitch.