The questions to ask an SEO company are about method, not promises: what exactly will you change on my site, can I see every change, where will any links come from, who checks the facts in the content you write, which data will you report from, and what happens to my accounts if we stop working together. Google’s own guide to hiring an SEO asks most of these, and its September 2026 spam update, which finished rolling out on 8 October, is a fresh reminder of why the answers matter. xCreative™ is a creative and marketing agency in Chadstone, Melbourne, that runs SEO and AI search work for Australian businesses, and these are the questions we would want a client to put to us.
What the September 2026 spam update was
Google’s Search Status Dashboard lists the September 2026 spam update as starting on 24 September and running for 13 days and 16 hours, which puts the finish on 8 October in US Pacific time. It was the fourth spam update this year. The March, June and August updates each finished in under three days, so this one ran far longer than the others.
The dashboard records dates, not targets. What Google does publish is its list of spam policies, and that list reads like a catalogue of things a cheap SEO package might do on your behalf: paid links, pages mass-produced to catch search terms, suburb pages that all say the same thing, and old expired domains bought to pass their history to a new site. Google says sites that break these policies may rank lower or drop out of results entirely.
Two lines on Google’s spam updates page are worth reading before you sign anything. Recovery after fixing a problem can take months while Google’s systems relearn the site. And where Google neutralises spammy links, any ranking those links once provided cannot be regained. In plain terms: if a provider bought links for you and Google discounts them, the ground you paid for is gone.
Questions about the work itself
Start with what will physically change. A good answer names the pages, the page titles and descriptions, the structured data, the redirects and the technical fixes. A vague answer talks about “optimisation” and “authority” without saying where on your site either happens.
- Do you follow Google Search Essentials? Google’s hiring guide suggests asking this directly, and also asking whether the provider can point to Google documentation behind its recommendations.
- Will you show me every change and explain why? The same guide lists this as a question to ask. A written change log is a reasonable expectation.
- What access do you need for the audit? Google advises giving read access to Search Console during an audit, not write access. Admin access to your website can wait until you have seen the audit and agreed on the work.
- What results do you expect, by when, and how will we measure them? Agree on this before work starts.
If a redesign or rebrand is coming, ask how the SEO work fits around it. We covered that sequence in rebranding without losing your Google rankings.
Questions about links and content
This is where spam updates bite, so ask in detail.
- Where will links to my site come from? Ask for examples of the actual websites. Links from industry associations or local media are a different thing from links bought on blog networks that exist to sell them. Google’s hiring guide also notes you should never have to link to the SEO company’s own site as part of the deal.
- How many pages do you plan to publish, and who writes them? Google’s scaled content abuse policy covers pages produced in bulk mainly to rank, whether a person or a program wrote them. A plan to publish a page for every suburb in Melbourne with only the suburb name changed is exactly what that policy describes.
- Who checks the facts? Content about your business should come from your business: services you actually offer, places you actually work, projects you can name. Ask whether you approve each page before it goes live.
- What will you do about AI search? Google’s hiring guide now lists optimising for generative AI as a service SEOs offer, and suggests checking that any advice labelled AEO or GEO lines up with Google’s own guidance. Most of it is the same work as good SEO.
Reporting and ownership, plus the warning signs
Ask which data the monthly report comes from. Google Search Console is Google’s own record of how often your pages appeared in search and how often people clicked. Google Analytics shows what those visitors did next. Rankings from paid tools are useful, but they are a third party’s sample, not Google’s data.
Then ask who owns what. Your Search Console property, your Analytics account, your Google Business Profile and your domain should be in your name, with the agency added as a user. If you part ways, you remove a user rather than negotiate a handover.
Finally, ask how they would explain a drop. A provider who lines up the dates in Search Console against the dates on the Search Status Dashboard is reading the evidence Google publishes. One who blames “the algorithm” without dates is guessing.
Google’s hiring guide is blunt about a few of these. Nobody can promise a top position on Google, and nobody has a special relationship with Google or a priority way to submit your site. The guide also warns about unsolicited emails from SEO firms. A cold email that opens with how badly your site ranks is a sales script, not an audit.
Other answers worth questioning: a fixed number of links per month, a contract you cannot leave for a year before seeing any results, a refusal to say which pages were changed, or reports that only ever show rising lines from a tool you cannot log in to. The guide also reminds site owners that they remain responsible for what a hired company does to their site. If a provider breaks the spam policies, the penalty lands on your domain, not theirs.
How we answer these questions at xCreative
Our SEO, GEO and AI search service starts with an audit written in plain language, then technical fixes, then pages built from the client’s real facts and reviewed by the client before they publish. Monthly reports come from Google Search Console, with AI visibility checks alongside. We do not promise rankings, and our service page says so. The techniques we sell run on our own site first, including the time an audit found 63 of our case study pages hidden from Google by a leftover noindex tag, which is why indexing is the first thing we check on any site.
For shops and trades, the map results matter as much as the main results, and our local SEO service covers the Business Profile and the reviews that feed it. For businesses asking how to appear in answers from ChatGPT, Gemini or Claude, our AI search optimisation page explains what we do and how we test it. If you want these questions answered for your own site, get in touch.
Frequently asked questions
Was my site affected by the September 2026 spam update?
Compare your Search Console clicks and impressions for 24 September to 8 October against the weeks before. A sharp fall inside those dates, with no site changes or seasonal reason, is worth investigating against Google’s spam policies. A steady line means the update most likely passed you by.
Can an SEO company get me to the top of Google?
No one can promise that. Google’s guide to hiring an SEO says so directly. A good provider can tell you what work they will do, how it should help and how you will measure it, then show you the results from Search Console each month.
Should I give an SEO company access to my website?
For an audit, read access to Search Console is enough, as Google recommends. Website admin access makes sense once you have agreed on the work, and it should be a separate user account you can remove, not your own login.
Related reading: Best AI SEO agency: how to judge GEO services before you pay
