How to Fire an SEO Agency Without Losing Rankings

Most owners fire an SEO agency the same way they fire a landscaper: send an email, stop paying, move on. Then the Business Profile stops accepting edits, the blog on the subdomain 404s, the tracking numbers on the truck wraps go dead, and nobody can log into Search Console to see what happened.

None of that is bad luck. It is what happens when the person you just fired is still the owner of record on every asset that produces your leads. Firing an agency is the highest-risk marketing operation a service business ever runs, and almost nobody sequences it.

This is the runbook: what to transfer before you say a word, the order to do it in, and what to watch for 30 days after they are gone.

When is it actually time to fire your SEO agency?

Fire them when you can name 90 days with no qualified leads from organic search and no plausible explanation for it — not when you are annoyed about a slow email reply. A ranking dip is not a firing offense. A reporting deck with impressions and no phone calls in it, month after month, is.

Google's own guidance for hiring an SEO says: 'No one can guarantee a #1 ranking on Google. Beware of SEOs that claim to guarantee rankings, allege a special relationship with Google, or advertise a priority submit to Google.' If your agency sold you a guarantee, that is a reason to leave. So is refusing to tell you what they changed — Google's list of questions to ask an SEO includes 'Will you share with me all the changes you make to my site.'

Before you decide, do the boring check first: pull the last two quarters of leads and match them to source. If you cannot do that, start with how to measure SEO ROI for a service business — firing an agency on a hunch and hiring the next one on a hunch is how owners end up three agencies deep.

What breaks the day you fire your SEO agency?

Five things break the moment access is revoked: your Google Business Profile edits, your Search Console history, your GA4 data, your call tracking numbers, and any content that lives on infrastructure they own. Every one of them is silent — nothing sends you an alert.

The pattern is always the same. The agency did the work, so the agency created the accounts. The accounts were created on their Google Workspace login, their CallRail, their staging subdomain. You were added as a guest to your own business.

The content one is the quiet killer. If your blog was built on a subdomain the agency controls, none of those pages are yours in any way that survives the relationship. Same story with a site the agency built and hosts — read who owns your website when you leave a designer before you assume the codebase is yours.

What must you transfer before you give notice?

Seven things, and all seven have to be in your name before you send the email: the domain registrar account, DNS control, hosting, the CMS admin login, verified owner status in Search Console, Administrator in GA4, and primary owner of your Google Business Profile.

Roles matter more than logins. Google's Search Console documentation defines an Owner as someone who 'has full control over properties in Search Console' and 'can add and remove other users, configure settings, view all data, and use all tools,' while a full user only 'has view rights to all data and can take some actions.' Being a full user feels like access. It is not control — you cannot add or remove anyone, including the agency.

GA4 works the same way. Google's Analytics roles documentation says an Administrator has 'full control of Analytics' and 'can manage users,' while an Editor has 'full control of settings at the property level' but 'can't manage users.' Roles also inherit downward: 'Parent roles are inherited by default (e.g., account > property).' If the agency holds Administrator at the account level, being an Editor on the property is decoration.

Ad accounts have their own ownership trap, and it is a different mechanism from all of this. Handle it separately with who should own your Google Ads account.

In what order do you take back ownership roles?

Bottom of the stack first, in this order: domain registrar, DNS, hosting, CMS, Search Console, GA4, Google Business Profile, call tracking. The reason is simple — the domain and DNS control everything above them, and the Business Profile has a built-in delay that will stall you if you leave it for last.

• Step 1: Domain registrar. Make sure the domain is registered to your business, with your email as the registrant contact and your card on the renewal. If it is in the agency's registrar account, request a transfer now — this takes days, not minutes.
• Step 2: DNS. Confirm you can log in and see the A, CNAME, MX, and TXT records. TXT records matter: some Search Console verification tokens live there.
• Step 3: Hosting and CMS. Get an admin account in your name, then confirm a second admin exists that is not the agency's.
• Step 4: Search Console. Verify yourself as an owner using a method you control (DNS TXT record or a file on your own hosting), not one that depends on their tag manager.
• Step 5: GA4. Get Administrator at the account level, not just the property.
• Step 6: Google Business Profile. Become an owner, then start the 7-day clock before you can take primary ownership.
• Step 7: Call tracking. Move numbers into an account billed to your card, or port them out.
• Step 8: Only now, give notice.

Do this while the relationship is still calm. 'We are tightening up our access hygiene and want ownership on our side of everything' is a normal, boring request that a decent agency will complete in a day. A dishonest one will stall, and the stall itself is your answer. If you want an outside pair of eyes on what is actually in your accounts, that is exactly what a free audit is for.

Who is the primary owner of your Google Business Profile?

There is exactly one, and if it is not you, you are a guest on the asset that drives your map pack calls. Google's Business Profile documentation states that a profile can have 'multiple owners but only one primary owner,' that owners can 'add or remove users, manage profile info, and even delete the profile,' and that managers 'can't add or remove users or remove the profile.'

Two timing rules will bite you. First, Google says that when you become an owner or manager, 'you have to wait 7 days before you can manage some profile features,' including the ability to transfer primary ownership. Second, Google says: 'If you're the primary owner, you can't remove yourself until after you transfer primary ownership to someone else.' So the agency cannot hand it over on their last day even if they want to — the clock starts when you are added, not when they leave.

If they have already ghosted you and you cannot get added at all, you can request ownership through Google. Per Google's documentation, the current owner is notified by email and has '3 days to respond' to that request, and if they do not, you may be able to claim the profile — though Google notes 'the option to claim a profile isn't always available.' That is a recovery path, not a plan. Get added as an owner while they still answer your calls, then clean the profile up with the Google Business Profile optimization checklist.

What happens to your tracking numbers and call data?

If the numbers were provisioned inside the agency's CallRail or CTM account, every one of them — plus every historical recording and every call attributed to a keyword — sits in an account you cannot log into and do not pay for. When they close it, the numbers stop routing.

That is worse than it sounds, because tracking numbers do not stay in one place. They end up on your Google Business Profile, your website header, your Google Ads call extensions, your truck wraps, and your review-request texts. Kill the account and the phone stops ringing on channels you did not even know were pointed at a rented number.

• Ask which numbers exist, where each one is published, and which phone line it forwards to. Get it in a spreadsheet.
• Move billing to your card, or open your own account and port the numbers into it. Porting is a carrier process — start it weeks before notice, not after.
• Export call recordings and call logs before the account closes. Historical data does not port with the number.
• Check your GBP primary number: if it is a tracking number that dies, your map pack listing points at a dead line. Keep your real number as the primary and use the tracking number in the website field only.

How do you give notice without triggering a spite-deindex?

Give written notice only after every transfer is confirmed, on the same day you downgrade their write access to read-only — and check whether your contract's notice clause is 30, 60, or 90 days before you send anything, because that window starts when notice is received, not when you decide.

The 'spite-deindex' fear is mostly overblown and occasionally real. An agency with CMS admin and Search Console owner rights can noindex your site, delete pages, remove redirects, or submit removal requests. Most will not — it is career suicide in a small industry. But you do not need to find out. Remove the capability, then give the notice.

Google's guidance on working with an SEO points the same direction: when an SEO is doing an audit, 'only grant read access to Search Console (at this stage, don't grant them write access).' If read access is the right level for an agency you are hiring, it is certainly the right level for one you are firing. Google also states plainly that 'you are responsible for the actions of any companies you hire' — the cleanup is yours either way.

• Downgrade, do not delete, on day one: move them to full user in Search Console and Viewer in GA4 so you can still ask questions.
• Rotate every shared password and revoke every OAuth app connection on the CMS, hosting, and registrar.
• Remove their verification tokens from your site — the HTML file, the meta tag, the DNS TXT record, and any Analytics or Tag Manager container they own.
• Get a written handover: content inventory, redirect map, link acquisitions, and a list of anything published off-domain.
• Send notice by email, reference the termination clause, and state the last billable day. Keep it short and unemotional.

The token step is the one everyone skips, and Google's own documentation explains why it matters: if verified owners are removed without deleting their verification tokens, those people can re-verify ownership and regain access — and current owners get a notification when a previously removed owner reverifies. Removing them from the user list is not the same as removing them from your site.

What do you monitor for 30 days after they are gone?

Four things, checked weekly for four weeks: index coverage in Search Console, your Business Profile for unauthorized edits or suspension, 404s and broken redirects, and organic clicks and calls against the prior 90-day baseline.

Take the baseline before you fire them, not after. Export 90 days of Search Console clicks by page and query, export GA4 conversions by landing page, and screenshot your GBP insights. Without a baseline you cannot tell a real drop from the normal week-to-week noise — and you will spend the next quarter arguing with yourself about it.

If you have never used Search Console beyond glancing at the graph, get the mechanics down first with the Search Console guide for service businesses. Owner-level access is the single most valuable thing you take back in this whole process — it is the only account that tells you the truth about what Google is doing with your site.

One more thing: do not hire the replacement before the transfer is done. The new agency inherits whatever mess exists, and if they start work while the old one still holds owner rights, nobody can tell you who broke what.

If you are staring at an agency you no longer trust and you do not know what they actually control, start with an access inventory. We can run one as part of a free audit — no pitch, no contract, and if you decide to keep them, you at least know what you own. When you are ready for what comes next, our SEO services are month-to-month, no lock-in, and everything is created in your accounts from day one.