Every SEO engagement starts with data access — and every delayed engagement starts with data access that wasn't requested upfront.
The client signs the scope. Your team starts work. Day 3: you realise GA4 hasn't been set up, Google Search Console has no one verified, rank tracker has no baseline, and the client's marketing manager who handles credentials is on holiday for two weeks.
Data access belongs in scope — not as an afterthought, but as a gated prerequisite. If access isn't provided within the agreed window, the engagement timeline shifts. This checklist defines what you need, why you need it, and when you need it.
Who this is for
- SEO agencies onboarding new clients
- Account managers creating SOWs that depend on analytics data
- Teams where data access delays are a recurring bottleneck
- Consultants who need a copy/paste access requirements section for proposals
Access requirements by tool
Google Search Console (GSC)
| Requirement | Detail |
|---|---|
| Access level | Full user (not restricted) — needed for URL inspection, sitemap submission, and settings |
| Property type | Domain property preferred (covers all subdomains and protocols) |
| Verification | DNS verification recommended for domain properties |
| Setup timeline | Property must be verified at least 2 weeks before audit (for data population) |
| Historical data | GSC retains 16 months of data — verify property has history |
Google Analytics 4 (GA4)
| Requirement | Detail |
|---|---|
| Access level | Analyst or Editor role (read + explore access) |
| Property setup | GA4 property (not Universal Analytics — sunset July 2024) |
| Data streams | Web data stream configured and collecting data |
| Conversions/key events | Key events defined (purchase, lead, sign-up — relevant to business) |
| Data retention | Set to 14 months (not default 2 months) — critical for year-over-year reporting |
| Cross-domain tracking | Configured if site spans multiple domains |
| Internal traffic filters | Applied to exclude client and agency IP addresses |
| Google Signals | Review status (affects data thresholds and reporting) |
Rank tracking tool
| Requirement | Detail |
|---|---|
| Tool | [Specify: Ahrefs, SEMrush, Accuranker, or other] |
| Access | Shared project or read access to existing tracking |
| Keyword set | [X] keywords to be tracked (or "to be defined during onboarding") |
| Tracking frequency | Daily / weekly / monthly |
| Locations | Tracking locations defined (country, city, postcode) |
| Device | Desktop and mobile tracked separately |
| Competitors | [X] competitors configured for comparison |
Crawl tool access
| Requirement | Detail |
|---|---|
| Tool | [Specify: Screaming Frog, Sitebulb, Lumar, or other] |
| Crawl permissions | Robots.txt allows crawl tool user agent (or staging environment provided) |
| Staging access | Staging URL and credentials (if pre-launch or migration work) |
| Crawl frequency | Baseline crawl at engagement start, then [monthly/quarterly] |
Required access (before work begins)
- Google Search Console — full user access to verified property
- Google Analytics 4 — Analyst role or above
- CMS admin access — [specify: WordPress, Shopify, etc.] with content edit permissions
- Rank tracking tool — shared project or credentials for [tool name]
- Crawl permissions — robots.txt allows [tool user agent] or staging environment provided
Recommended setup (within first 2 weeks)
- GA4 data retention set to 14 months
- Key events / conversions configured for primary business goals
- Internal traffic filter applied (agency + client IPs)
- GSC domain property verified (if not already)
- Rank tracker baseline keyword set configured
Access provision timeline
- All required access must be provided within [X] business days of engagement start
- Engagement timeline begins from access confirmation date, not contract signing date
- Delays in access provision shift all subsequent deliverable dates by equal duration
- Access requests will be consolidated into a single onboarding email with step-by-step instructions
GA4 configuration checklist
Critical settings
- GA4 property created and data stream active
- Data retention set to 14 months (Admin > Data Settings > Data Retention)
- Key events configured (purchase, lead form submission, phone click — as relevant)
- Enhanced measurement enabled (scroll, outbound clicks, site search, file downloads)
- Internal traffic filter created and activated
- Cross-domain tracking configured (if applicable)
- Google Search Console linked to GA4 property
Reporting verification
- Organic traffic visible in Acquisition reports
- Landing page report showing data
- Conversions tracking correctly (test with real or debug events)
- No duplicate event tracking (check for double-firing tags)
- Referral exclusion list configured (payment gateways, SSO providers)
GSC configuration checklist
- Domain property verified (DNS method preferred)
- All relevant URL variations covered (www, non-www, HTTP, HTTPS)
- XML sitemap submitted and showing indexed status
- No critical coverage issues (noindex errors, redirect issues)
- International targeting configured (if applicable)
- URL parameters tool configured (if applicable)
- Agency team members added as full users
Common data access problems
GA4 not set up at all. More common than expected, especially with smaller businesses. Budget 1–2 hours in onboarding to verify and configure. If a full GA4 setup is needed, scope it separately.
Universal Analytics nostalgia. Some clients still reference UA data. GA4 data starts from when the property was created — there's no backfill. Set expectations about historical comparison limitations.
Data retention at 2 months. GA4 defaults to 2-month data retention for exploration reports. If this isn't changed to 14 months immediately, historical data is permanently lost. Check this on day 1.
GSC property not verified. If no one at the client's organisation has verified a GSC property, you'll need DNS access or server file upload access. This can take days if the client's IT team is involved.
Rank tracker keyword list undefined. "We'll track keywords" isn't a scope. Define the initial keyword count, selection criteria, and who approves the final list. Keyword selection can itself take 2–4 hours.
How RuleDox helps
Data access is the most standardised — yet most forgotten — part of SEO scoping. The same requirements apply to every engagement, but they're easy to leave out of a custom-built scope. Then the project starts late because nobody asked for GA4 access.
With RuleDox:
- Access requirements auto-populate based on engagement type — audit scopes get audit-relevant tools; retainers get monitoring tools
- Timeline gates are built in — "engagement starts from access confirmation" appears automatically
- GA4 and GSC checklists are standard — same requirements every time, no manual assembly
- Tool-specific sections toggle — if the agency uses Ahrefs, SEMrush fields don't appear
FAQ
Should data access be a separate scope item or embedded in the main SOW? Embedded. Include it as a prerequisites section in the main scope with a clear timeline gate. If you make it a separate document, clients deprioritise it. If it's in the SOW with "engagement timeline starts from access confirmation date," clients respond faster.
What if the client doesn't have GA4 set up? Scope GA4 setup as a separate line item (2–4 hours for basic setup, 4–8 hours for full configuration with conversions and filters). Don't absorb it into the SEO engagement — it's a different skill set and deliverable.
How do I handle clients who won't provide full access? Document the limitation in scope. "Restricted GA4 access means conversion data will not be included in reporting. Rankings and traffic data will be sourced from [GSC / rank tracker] only." Protect yourself from "why didn't you report on revenue?" conversations later.