How long should SEO client onboarding take?

Access and the baseline usually fit in the first week if the client replies quickly. Chasing access is the slow part, so ask for it in the kick-off call and say exactly which role you need on each account.

What if nobody knows who owns the client's Search Console property?

If you or the client's developer can edit DNS, add a TXT verification record to become a verified owner. You can then see every user and owner on the property and review the ones that should no longer be there.

Should I share the baseline with the client?

Yes. A short summary at the end of the first week dates the starting point in writing. It also surfaces problems that existed before you started, so they are not attributed to your work later.

When should the baseline be updated?

After any planned change you sign off, such as a redesign or a migration, so the reference reflects the intended state. Any other difference from the baseline is something to investigate.

Does Deltio show what a site looked like before I added it?

No. The first sitemap snapshot and SEO scan after you add a site become the starting point, and later checks are compared against them. Changes from then on trigger alerts by email or Slack.

← Back to the blog

SEO Client Onboarding Checklist: What to Record in Week One

An SEO client onboarding checklist has one job that most kick-off templates skip: recording how the site looks on the day you start. Get access to the right accounts, then write down the current state of robots.txt, the sitemap, indexing, tracking tags, certificate and domain dates, and the titles and meta descriptions of key pages. Without that record, you cannot show later whether a problem was there before you or arrived on your watch.

Access first, and in the client's name

Ask for access in the first conversation, not the first report. The list is short:

Google Search Console, ideally a Domain property, with you added as a Full user
GA4, with Editor or Analyst role on the property
Google Tag Manager, with Publish rights only if you will actually publish
the CMS, with your own named account rather than a shared login
read access to hosting or the deployment pipeline, if releases happen there

Every account should stay owned by the client. When the relationship ends, removing you should take one click, and nothing they paid for should leave with you. Note in the onboarding document who owns each property and who else has access. Former agencies and ex-employees still listed as owners are a common find. Flag them to the client rather than deleting them yourself.

Freeze a copy of robots.txt and the sitemap

Open /robots.txt and save the full text with today's date. Do the same for the XML sitemap. If it is a sitemap index, record each child sitemap and its URL count. A text file or a spreadsheet tab is enough.

These two files change more often than anyone admits. A plugin update rewrites robots.txt, a developer excludes a post type from the sitemap. With the day one version, comparing takes a minute. Without it, you are guessing. Our guide on how to check robots.txt lists the lines worth reading closely.

Record indexing status before you touch anything

In Search Console, open the Page indexing report and write down the indexed and not indexed totals, plus the main reasons under "Why pages aren't indexed". Take a screenshot too, because the report keeps a limited history.

Then spot check the pages that matter commercially: the homepage, the main service or category pages and a few top landing pages from GA4. Run URL Inspection on each and note the index status, the Google-selected canonical and the last crawl date. How to check if a page is indexed explains what each status means.

Tags, tracking and consent

View source on the homepage and on one template per page type (product, article, contact). Search for the GA4 measurement ID, which starts with G-, the GTM container ID starting with GTM-, and any other pixel you find, such as Meta Pixel, Hotjar, Microsoft Clarity, LinkedIn Insight or TikTok. Write down each ID and where it appears.

Two GA4 IDs on one page, or an ID that does not match the property you were given, belongs in your first report. Do not fix it silently. Also note which cookie banner or consent platform is running, since a change of provider is a frequent reason tags stop firing. How to check GA4 is installed has a step by step method.

Expiry dates nobody has written down

Check the SSL certificate issuer and expiry date from the padlock in the browser, and the domain expiry date and registrar through a WHOIS or RDAP lookup. Then ask the client who receives the renewal emails. Surprisingly often it is someone who no longer works there.

The on-page snapshot

For the pages you spot checked, record the title tag, meta description, H1, canonical, lang attribute and any hreflang annotations, and put them in a sheet. This is your reference when a developer reworks a template six months from now and rankings move.

Stick to the pages that bring in money or traffic. Recording every URL by hand is not realistic on a large site.

Keeping the baseline current

A baseline only helps if someone compares against it. Deltio does that comparison continuously. It takes a daily snapshot of the sitemap and keeps the last seven with a diff, alerts on robots.txt changes showing the lines added and removed, and compares consecutive SEO scans of title, meta description, H1, canonical, lang and hreflang. It also tracks marketing tags, the cookie banner provider, uptime every 10 minutes, SSL and domain expiry. The access audit and the Search Console review stay manual.

Starter costs £24 a month, or £20 a month billed annually, and you can add a new client's site on a 14-day trial.

Frequently asked questions

How long should SEO client onboarding take?: Access and the baseline usually fit in the first week if the client replies quickly. Chasing access is the slow part, so ask for it in the kick-off call and say exactly which role you need on each account.
What if nobody knows who owns the client's Search Console property?: If you or the client's developer can edit DNS, add a TXT verification record to become a verified owner. You can then see every user and owner on the property and review the ones that should no longer be there.
Should I share the baseline with the client?: Yes. A short summary at the end of the first week dates the starting point in writing. It also surfaces problems that existed before you started, so they are not attributed to your work later.
When should the baseline be updated?: After any planned change you sign off, such as a redesign or a migration, so the reference reflects the intended state. Any other difference from the baseline is something to investigate.
Does Deltio show what a site looked like before I added it?: No. The first sitemap snapshot and SEO scan after you add a site become the starting point, and later checks are compared against them. Changes from then on trigger alerts by email or Slack.