Your Google Search Console is owned by whoever proved ownership of it, and that's often the person or company that built your website, not you. That ownership doesn't end when the contract does. It stays until someone removes it, so a vendor you stopped working with years ago can still be listed as an owner today.
The good news: it takes about ten minutes to check, and you can take it back.
What Search Console is, and why ownership matters
Search Console is Google's free dashboard for your website. It shows the searches people use to find you, the pages Google has in its index, and any problems Google has reading your site. It's also where a sitemap gets submitted and where Google sends warnings about security issues.
An owner has the run of the place. In Google's words, owners "can add and remove other users, configure settings, view all data, and use all tools." That's a lot of access to leave with someone who no longer works for you, even someone you parted with on good terms.
How it happens
Nobody plans for this. It happens because of how ownership works.
To become an owner, someone proves they control the site: usually with a small tag on the home page, a file on the server, or a record in your domain's settings. Google calls the person who did that a verified owner. A verified owner can then make other people owners without any tag at all. Google calls those delegated owners.
Now picture the usual launch. Your web designer sets up Search Console with their own Google account, because they're the one at the keyboard. Maybe they add you, maybe they don't. Years pass. The designer moves on, sells the business or joins another firm, and can hand that ownership to someone new without you ever hearing about it. None of it expires on its own.
A real example
A client's marketing lead forwarded us an email from Google: a company she'd never heard of had just been added as an owner of her website's Search Console. She opened the owner list to check, and the company wasn't on it.
Both things were true. Search Console has two kinds of property for the same website. A Domain property covers the whole domain, every version of the address at once. A URL-prefix property covers only addresses that start a certain way, like https://www. Each property keeps its own list of users, so she was looking at one list while the email was about the other.
The history explained the rest. A former web vendor had verified ownership with their personal Gmail address, using a tag on the old site. Later, that vendor joined another company and made it a delegated owner. Nobody at the business was asked or told, beyond that one automated email.
The fix took one afternoon: remove both, clear out the old verification records, and put ownership on an account the business controls.
How to check yours
You'll need to sign in to Search Console (opens in a new tab) with a Google account that has access. If you can't get in at all, that's an answer too (see below).
- Look at every property. In the property menu at the top left, check for a Domain property (
yourbusiness.com) and every URL-prefix property (http://,https://, with and withoutwww). Each has its own users. - Open Settings, then Users and permissions. Every owner and user is listed here. Anyone you don't recognize, or anyone who no longer works with you, is worth a question.
- Read the ownership history, not just the list. Google keeps "a history of ownership events, including owners added and removed." It shows who added whom, and when. A delegated owner can be on the list without ever having verified anything, and the history is the only place that shows how they got there.
- Check your domain's verification records. In the DNS settings where your domain is managed, look for TXT records that start with
google-site-verification. Each one is a standing key for whoever holds the matching Google account. Keep the ones that belong to you. - Remove what shouldn't be there. For a user or delegated owner, open the menu beside their name and choose Remove access. A verified owner is different: Google says "to add or remove a verified owner, you must add or remove a token on the site," so the tag, file or DNS record has to go first. If it doesn't, Google warns, "the removed owner will be able to re-verify ownership if they choose to."
Google's own help page, Manage owners, users, and permissions (opens in a new tab), walks through each step.
If you can't get in at all
If you've never had access, you can still become a verified owner yourself: add the property, verify it with a DNS record at your domain, and you're in. Your domain is the one key that outranks the rest, which is why it should always be registered to you.
Once you're in, read the history before removing anyone. If a current vendor still needs access to do their work, they can keep it. The goal is a list where every name has a reason to be there.
While you're at it
Search Console is the easy one. The same thing happens with other Google accounts, and some of them matter more:
- Google Business Profile, your listing on Maps, with your reviews and hours. It's worth the most and it's the one most often owned by someone else.
- Google Analytics and Google Tag Manager, which hold your visitor history.
- Google Ads, if you've ever run ads.
The same rule holds for all of them: you own it, from a business address that doesn't belong to one employee, and everyone else gets the access their work needs.
A new website is a good moment to sort this out, since it's when old tags tend to come off the site anyway. We check every account a domain has picked up before a launch, and it's part of what we cover when a site moves. If you'd rather have someone keep an eye on it for you, that's part of Website Care, or ask us to take a look.
