How to choose an SEO agency: the 2026 buyer's guide

How to choose an SEO agency: the 2026 buyer's guide

Search engine optimisation is one of the hardest services to buy well. The work is often invisible, results take time, and many factors outside the agency's control affect rankings. It is also a field where some shortcuts can do lasting harm, and where you may not find out what was done to your site until the damage shows.

The good news is that you do not have to take anyone's word for what works. Google publishes detailed guidance on what it wants from websites, what it treats as spam, and even what to ask when hiring an SEO. This guide uses that guidance to help UK, European and US businesses choose an agency. It covers what legitimate SEO involves, what Google's spam policies say to avoid, how to brief an agency, what to ask before you sign, what the contract should cover, the warning signs, how to compare proposals, and how to use TrustList's digital marketing rankings to build a shortlist.

We do not quote fees, traffic uplifts or ranking "success rates". They vary widely, and we have not found public figures we can verify. The guidance we refer to is listed under Sources at the end.

What legitimate SEO work involves

Google's SEO Starter Guide describes SEO as "helping search engines understand your content, and helping users find your site" and decide whether to visit it. Everything a good agency does should serve that aim.

Google's own page on hiring an SEO lists what one can offer: a review of your site's content or structure; technical advice on hosting, redirects, error pages and JavaScript; content development; management of online business development campaigns; keyword research; SEO training; expertise in particular markets and countries; and optimising for generative AI. In practice, the work falls into a few areas.

Technical work

Technical SEO makes sure search engines can find, crawl and index your pages, and that the site's structure makes sense. It covers site architecture, internal links, redirects, duplicate pages, structured data and page experience.

Google's Core Web Vitals give three measurable targets for page experience: Largest Contentful Paint within 2.5 seconds, Interaction to Next Paint under 200 milliseconds and Cumulative Layout Shift under 0.1. Google recommends achieving good scores, but they are part of a wider picture, not a ranking guarantee.

Site migrations need particular care. If you are changing domain, platform or URL structure, Google advises mapping old URLs to new ones, using server-side permanent redirects and keeping them "for as long as possible, generally at least 1 year". It also warns you to expect temporary ranking fluctuation during a move. An agency that has run migrations should be able to explain its plan in detail.

Content

Google's guidance on helpful, reliable, people-first content asks whether content is made primarily for people or to attract visits from search engines. It encourages site owners to think about who created the content, how and why.

On automation, Google draws the line at purpose: "If you use automation, including AI-generation, to produce content for the primary purpose of manipulating search rankings, that's a violation of our spam policies." Ask any agency that produces content at volume how it is researched, reviewed and fact-checked, and who is named as the author.

Links and digital PR

Links from other sites are one way search engines discover pages, although Google's starter guide notes that there is much more to Google Search than links. Legitimate work earns links, for example through original research, useful tools or genuine press coverage. Where a link is paid for, such as in sponsored content, Google asks for it to be marked with the rel="sponsored" attribute.

Local search

For businesses serving a local area, SEO includes your Business Profile on Google. Its guidelines say your name should reflect your real-world business name, and warn: "Including unnecessary information in your business name isn't permitted, and could result in the suspension of your Business Profile." An agency that suggests adding keywords to your business name is putting your profile at risk.

AI features in search

Some agencies now sell services aimed at AI-generated answers in search. Google lists "optimizing for generative AI" among the things an SEO might offer, but it also says: "There are no additional requirements to appear in AI Overviews or AI Mode, nor other special optimizations necessary." The best practices for SEO still apply. If an agency sells a separate AI search package, ask exactly what it does that ordinary good SEO does not.

How long it takes

Google's starter guide says: "Some changes might take effect in a few hours, others could take several months." It suggests waiting a few weeks before judging whether a change has helped. Plan your review points around that, and be wary of anyone promising quick, permanent gains.

What Google's spam policies say to avoid

Google's spam policies describe practices that can push a site down or out of search results altogether. The consequence is stated plainly: "Sites that violate our policies may rank lower in results or not appear in results at all." Google detects violations through automated systems and, where needed, human review that can lead to a manual action. A site owner learns of a manual action through the Manual actions report in Search Console, must fix the problem and then request a review, which Google says can take several days or weeks.

The policies most relevant when hiring an agency are:

• Link spam. Buying or selling links for ranking purposes, including exchanging money, goods or services for links, excessive link exchanges, and automated link-building.
• Scaled content abuse. Generating many pages mainly to manipulate rankings rather than help users, which Google says applies "no matter how it's created".
• Site reputation abuse. Publishing third-party content on a host site mainly to benefit from that site's existing ranking signals.
• Expired domain abuse. Buying an expired domain and repurposing it mainly to manipulate rankings with low-value content.
• Doorway abuse. Creating sites or pages to rank for similar search queries, such as pages aimed at many towns that all funnel visitors to one page.
• Cloaking, sneaky redirects, hidden text and keyword stuffing. Showing search engines something different from what people see, or loading pages with keywords.

Two more statements from Google are worth keeping in mind during any sales pitch. Its Search Essentials say: "It doesn't cost any money to appear in Google Search results, no matter what anyone tries to tell you." And meeting all of Google's requirements and best practices does not guarantee that a page will be crawled, indexed or shown.

How to scope and brief an SEO engagement

Choose the type of engagement

• An audit: a one-off review of technical health, content and links, with prioritised recommendations.
• A retainer: ongoing work on an agreed plan, usually combining technical fixes, content and reporting.
• A project: a defined piece of work, most often a site migration or redesign.
• A content programme: research and production of content to an agreed standard.
• Training and advice: helping your own team do the work.

If you are unsure, an audit is a sensible first step. It gives you a plan you own, which you can implement with the same agency, another one or your own team.

What to put in the brief

• Business goals. Which products, services or markets matter most, and what a valuable visit leads to, such as an enquiry or a sale.
• Current performance. Data from Search Console and your analytics, shared with read-only access.
• History. Past agencies and what they did, previous link building, migrations, and any manual actions.
• Your site and team. Your content management system, who can make technical changes and how quickly, and who approves content.
• Markets and languages. Where you want to be found, and in which languages.
• Budget and horizon. A realistic range, and when you will review progress.

Be honest about implementation. Many SEO recommendations need developer time. If your team cannot make changes for months, say so, and ask agencies how they would work within that.

What to ask before you sign

Google's own questions

Google suggests asking a potential SEO:

• Can you show me examples of your previous work and share some success stories?
• Do you follow the Google Search Essentials?
• What kind of results do you expect to see, in what timeframe, and how do you measure success?
• What is your experience in my industry, in my country or city, and with international sites?
• How long have you been in business?
• How will we communicate, and "Will you share with me all the changes you make to my site"?

Questions to add

• What would you do in the first three months, and what do you need from us?
• How do you earn links? Can you show examples for current clients? Do you ever pay for links or placements, and how are they marked?
• How is content researched, written, reviewed and credited? Where do you use automation?
• What will you report, and how will you connect it to enquiries or sales rather than rankings alone?
• Has any client site had a manual action while you worked on it? What happened?
• What happens to the content, links and accounts if we part ways?

Give access carefully

Google's advice is direct: during an audit, "only grant read access to Search Console (at this stage, don't grant them write access)". Search Console distinguishes owners, who have full control and can add and remove users, from full and restricted users with more limited rights. Keep ownership with your own organisation.

When an agency leaves, remove its users. If anyone from the agency was a verified owner, Google warns that you should also delete their verification tokens: "If you do not delete these tokens, the removed owner will be able to re-verify ownership if they choose to."

Contracts, ownership and data

Take legal advice on the contract. For SEO, make sure it covers:

• Accounts. Search Console, analytics, tag management, your Business Profile, your domain registrar and your DNS stay in your organisation's name, with the agency given the least access it needs.
• Content ownership. The UK Intellectual Property Office explains that commissioned work belongs to its creator unless you agree otherwise in writing, so the contract should assign content, research and reports to you.
• Links. A description of how links will be earned, and a commitment not to use practices that breach Google's spam policies. Links placed on sites the agency controls can disappear when you leave.
• Changes to your site. A written log of every change, made through your normal review and release process, with accounts protected by multi-factor authentication and removed at the end.
• Reviews. If the agency offers review generation, it must stay within the law. In the UK, fake reviews and concealed incentivised reviews are banned practices under the Digital Markets, Competition and Consumers Act 2024, and the CMA can fine a company up to 10% of its global turnover. In the US, the FTC's final rule on fake reviews and testimonials allows it to seek civil penalties against knowing violators.
• Personal data. If the agency can access personal data, for example through analytics or form submissions, UK GDPR requires processor terms, which the ICO lists.
• Term and exit. Deliverables described as outcomes and tasks rather than hours alone, a review point, a notice period and a handover.

Red flags when choosing an SEO agency

• A guaranteed ranking. Google says: "No one can guarantee a #1 ranking on Google."
• A cold email offering SEO. Google advises you to "be wary of SEO firms and web consultants or agencies that email you out of the blue".
• Secret methods, or reluctance to tell you what will change on your site.
• Link packages sold by quantity, or any offer to buy links that pass ranking credit.
• Plans to publish hundreds of near-identical pages, such as one page per town with only the name changed.
• Claims of a special relationship with Google, or of paid priority in results.
• Requests for owner access to Search Console before any work is agreed.
• Reports built on rankings for obscure terms that bring no enquiries.
• Expired domains bought to redirect or host content for your site.
• An "AI search" package that promises special optimisation Google says does not exist.

How to compare proposals fairly

Give every agency the same brief and the same read-only data, and share answers to questions with all of them. Agree your criteria and how much each counts before opening proposals.

Then compare:

• Diagnosis. Did the agency find specific issues on your site, or send a generic plan?
• Priorities. Is it clear what comes first and why?
• Dependencies. What does the plan need from your developers and content team, and is that realistic?
• Methods. How will content be produced and links earned, and does that sit comfortably within Google's spam policies?
• Measurement. Does reporting connect to business results?
• Deliverables and terms. What you get each month, who owns it, and how you can leave.

Do not ask for a full audit as part of an unpaid pitch. If two agencies are close, pay each for a short audit of part of your site and compare the quality of what you receive.

How to use TrustList to build a shortlist

As of September 2026, 1,689 firms on TrustList list search engine optimisation among their services, and 3,953 list digital marketing. The digital marketing rankings cover 4,821 companies, split into rankings by service and by location. Start from the one closest to your need, and check each profile to confirm that SEO is among the services listed.

How the rankings work. Rankings are ordered mainly by client reviews and by how complete a firm's profile is, with a smaller lift for verification and other trust signals. Few firms have reviews on TrustList yet, so do not treat a position as a verdict from clients. Our trust and methodology page explains how reviews are checked and how rankings stay independent. Sponsored placements are labelled, and payment never changes the organic order.

What vetting adds. Agencies that pass TrustList vetting have had their registration and website checked, and a client or published evidence has confirmed that they deliver what they sell. It shows an agency is real and active. It cannot tell you how the agency builds links.

A practical route to a shortlist:

1. Read the profiles of agencies that work in your sector and markets.
2. Put up to four side by side with compare.
3. Contact three or four from their listings, or post a request. Open requests are published to the requests board, so leave out details you would not want competitors to read.
4. Put the agencies that respond well through the questions in this guide.

A ranking can narrow the field. The answers to Google's own questions, a close read of each proposal and, ideally, a paid audit will show which agency is right for you. TrustList's rankings are not for sale.

Sources

• Search Engine Optimization (SEO) Starter Guide, Google Search Central
• Do you need an SEO?, Google Search Central, updated June 2026
• Google Search Essentials, Google Search Central
• Spam policies for Google web search, Google Search Central, updated August 2026
• Creating helpful, reliable, people-first content, Google Search Central
• AI features and your website, Google Search Central
• Understanding Core Web Vitals and Google search results, Google Search Central
• Qualify your outbound links to Google, Google Search Central
• How to move a site, Google Search Central
• Manual actions report, Search Console Help, Google
• Managing owners, users, and permissions, Search Console Help, Google
• Guidelines for representing your business on Google, Google Business Profile Help
• CMA to boost consumer and business confidence as new consumer protection regime comes into force, Competition and Markets Authority, 7 April 2025
• Reviews and social media endorsements: what businesses and content creators must know, Competition and Markets Authority
• Federal Trade Commission announces final rule banning fake reviews and testimonials, Federal Trade Commission, 14 August 2024
• Ownership of copyright works, Intellectual Property Office
• What needs to be included in the contract?, Information Commissioner's Office (ICO)