7

An SEO consultant has asked (demanded) credentials to the web environment so he can do ... Whatever it is that they do.

I'm new to the company but an experienced Systems Engineer. I've just now been brought into this situation, but my reaction to giving him credentials is a pretty solid "No" unless he can provide a compelling reason, which is yet forthcoming. Before I was brought into this, he had been provided an archive of the relevant files, but he said that this was insufficient.

The (admittedly) little that I know about SEO tells me that he should be able to get everything that he wants should be able to be gathered from view source or a copy of the files, and we would implement his changes in a production deploy after review.

Improve this question
6
  • 10
    See also Our security auditor is an idiot, how do I give him the information he wants?
    – Chris S
    Apr 25, 2012 at 17:02
  • 1
    @ChrisS I love that question, you beat me to the link ;)
    – Tim
    Apr 25, 2012 at 17:03
  • Yes, I love that question, too. I ask about SEO because I honestly don't know anything about the field.
    – gWaldo
    Apr 25, 2012 at 17:13
  • 1
    @gWaldo I added a little blurb about some stuff that he might want to do that's easier with direct server access (my last company had a small SEO team). I'm far from an expert, but from my understanding they don't need the access, it just makes it easier (we used to request full access from our clients for that reason, but if they couldn't/wouldn't give us that access we would work with them to complete the project without it.)
    – voretaq7
    Apr 25, 2012 at 17:20
  • 1
    I'd be a little worried about little black hat tweaks being slipped in - serving different content to Google, adding you into a link farm, etc.
    – ceejayoz
    Apr 25, 2012 at 17:41

3 Answers 3

Reset to default
12

Short answer: What Chris S said: See "Our security auditor is an idiot, how do I give him the information he wants?".

Long answer:

Some of what a "SEO Guy" needs to do might require server access -- for example, installing optimized mod_rewrite rules, adding custom 404 pages, creating friendly redirects (and/or optimizing existing 3xx redirects), etc.
None of this is something that you can't do for him, and none of it is black magic trade secrets (he's going to make these changes on your server, you could diff the config file later and see exactly what was done).

Because of that I personally don't see any need to give them access to make changes on the server (a read-only account sure, if you want, but no ability to affect changes without going through your company's approval process).
My advice:

  1. Say No.
    Be proud of your No, for you are on the side of good, and righteousness, and stability of your environment.
  2. Explain WHY you are saying no to your manager/supervisor/whoever is in charge.
    Pretty straightforward: "It's a giant security risk, he can just as easily give us his changes to push live so we can audit them first, yadda yadda yadda.".
    If you present solutions that still let the SEO guy get his job done while protecting your environment, and your higher-ups aren't insane, they will probably back you on this.
  3. Explain WHY you are saying no to the consultant and give him the alternate solutions.
    If it's a deal breaker for them let 'em walk. There are tons of SEO consultants out there...

If Management tells you to give him access anyway get that in writing. Issue a memo outlining the risks, and get someone above you to sign off on those risks (this is all about protecting you in the event this guy blows up your server).
You should also insist that the consultant sign something stating that they will be liable for any damages if they disrupt the stability of your environment (which is all about protecting the company).

Improve this answer
2
  • 1
    What about giving the consultant access to a testing environment running the same software stack as the production environment? Then you can see what changes he's made and are never in risk of any damage.
    – Tom Marthenal
    Apr 27, 2012 at 5:16
  • @TomMarthenal an excellent option if you can set up a dedicated sandbox - sometimes you can't let consultants loose in your dev environment because your developers need it to do Real Paying Work (or, horrors, you don't have a dev environment!), but if you can easily spin up a clone of production for the consultant to work in by all means do so!
    – voretaq7
    Apr 27, 2012 at 5:23
0

He should only need credentials to make on-page related changes.

For an analysis, you're right he can just view source. He could run into an issue during the on page analysis and it could be helpful to login from the backend, but not necessary..

Improve this answer
0

I would not suggest anyone give access to the live website to any SEO specialist. The reason for that is simple - the website's uptime and reliability are more important than its SEO score. The SEO specialist would use a test instance and once ready with any changes they want to apply to the web pages or CRM, they simply update the live environment.

However, note that at some point the SEO specialist should be able to test the changes they apply to the live website with some SEO software. So, there should be someone to assist them, if you do not want to give them access to the server or the website account.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .