Share Google Search Console Access Safely (Users, Owners, Delegates)

Why you should never share a Google password

Shared logins destroy audit trails and make removals painful. Search Console supports per-user access—use it with the least privilege required and MFA on every account.

Roles at a glance

• Owner (verified): full control; can add/remove users and configure settings.
• Full user: can view most data and take most actions.
• Restricted user: view-only on limited data.

Step-by-step: add access safely

1. Verify site ownership first (DNS/HTML file/Tag Manager).
2. Add a user by email with the least privilege needed (start restricted; escalate only if required).
3. Require MFA on all accounts. Need a memorable master? How to Create Strong Passphrases You’ll Actually Remember.
4. Verify invite links out-of-band before accepting. Link checks: Stop Phishing at the Source: Verify Links Like a Pro.

Handoff and offboarding

• Use individual accounts, not shared ones.
• Remove access at project end and rotate any related secrets (e.g., API keys) as part of your process. Incident plan: The Simple Incident Playbook for Leaked Passwords.
• Follow a clean onboarding flow for agencies: Secure Client Onboarding (Checklist).

Useful external references

• GSC: Manage users & permissions 🔗
• GSC: Verify site ownership 🔗
• Enable Google 2-Step Verification 🔗

Bottom line

Invite, verify, MFA—then remove when the work ends. No shared passwords, no surprises.

Secure One-Time Messages - Send confidential messages that self-destruct after being read once. Your privacy is our priority. →.