Search Console Verification: 2026 Guide
Imagine an agency in Austin starts work for an online store in Berlin on a Monday. The developer who set up Search Console years ago has left, a redesign wiped out the old HTML file, and nobody can say who still has access. The first job is not keyword research but a short, slightly awkward audit of who owns the property and how they proved it.
This guide is for in-house teams and agencies in the United States, Europe and South Korea who set up or inherit a property. It covers Search Console verification from end to end. That means the two website property types, every method and why it fails, the four access levels, and how to remove an owner for good. Every rule and number here comes from Google's own Search Console Help pages, named as we go, and the opinions are mine.
What does Search Console verification prove, and why is Google so strict?
It proves to Google that you control a specific website. Google's Help page on verifying ownership says a verified owner "has the highest degree of permissions in Search Console," and that is the whole point. Owners can see sensitive Google Search data and take actions that affect how a site shows up on Google Search, so Google asks for proof first.
My advice is to treat ownership like the login to a bank account, not a setup chore you tick off once. Google's Help page on verifying site ownership says verification lasts only as long as Search Console can confirm your token. It checks the token from time to time and tells you when the check fails. If nobody fixes it, your rights expire "after a certain grace period," and the page gives no length for it. For a wider tour of the main reports, see our practitioner's guide to Google Search Console.
Do you need a Domain property or a URL-prefix property?
Choose a Domain property when you want every subdomain and protocol in one view, and a URL-prefix property when you want one exact URL prefix. Google's Help page on adding a property says a URL-prefix property "Includes only URLs with the specified prefix, including the protocol," so http and https split apart. My advice is to keep both.
A URL-prefix property for the http version of example.com does not match the same page on https, or on the www subdomain. A Domain property for example.com matches all three, plus deeper subdomains such as support.m.example.com. For example, a US retailer can keep its www site and its mobile subdomain in one Domain property. A German publisher is different, because the Help page says the public suffix is part of the property name, so its example.com and example.de sites must be two separate Domain properties. A Korean brand in Seoul on a .co.kr domain gets the easy case, with every subdomain under that name in one Domain property. For country routing, see our guide to hreflang and international site structure. Korean teams should also read our guide to Naver SEO for Korean search, which covers how Naver verifies site ownership.
How can you split Domain data by country folder or subdomain?
Use one of two techniques from Google's Help page on adding a property. Add a page filter in the Performance report to see one subdomain or protocol. Or add a URL-prefix property for each folder you want to track, such as a France, Ireland or Spain section, and keep the Domain property so one view still holds everything.
Google's Help page on adding a property uses a travel site as its example. It suggests one property for the whole site, one for each country folder, and one for the mobile subdomain. I like this setup for any European site with country folders, because each country team gets its own clean view. A page filter suits one-off questions, and for many folders at once, our guide to regex filters in the Performance report shows how to build the pattern.
How do you verify a Domain property with a DNS TXT record?
Log in to your domain name provider and add the TXT record Search Console gives you. Google's Help page on verifying ownership calls the DNS method "the only way to verify a Domain property," and it takes a few steps. The same page says a record you add by hand can take up to two or three days to start serving. Then click Verify and keep the record.
If Search Console lists your provider, pick it and log in, and the check should happen right away, but if not, follow these manual steps.
- Open the Google Admin Toolbox on its CNAME tab and enter your domain name.
- If it finds no record, which the page calls the most common case, use a TXT record.
- If it finds a CNAME whose target is a parent of your domain, use a CNAME record whose value includes dv.googlehosted.com.
- Add the record at your provider, and for a TXT record leave the host field blank or set it to "@" as your provider asks.
- Paste the string from Search Console into the value field, then click Verify.
- If it fails, wait a day or two and try again, as the page advises.
The Help page is blunt on one point, telling you "don't remove the DNS record from your provider, even after verification succeeds," because the check repeats. Verifying the root domain covers every subdomain, but the page says verifying m.example.com covers pets.m.example.com and not example.com itself.
Which Search Console verification method fits a URL-prefix property?
Use whatever you already control. Google's Help page on verifying ownership lists these options for a URL-prefix property: an HTML file, an HTML tag, the Google Analytics code, Google Tag Manager, or your domain name provider. Google Sites and Blogger have their own route. I would set up two methods, so one broken template cannot lock you out.
Every row in this table is taken from Google's Search Console Help page on verifying ownership.
| Method | Works for a Domain property? | What you need | The usual failure |
|---|---|---|---|
| HTML file upload | No | A file in the root folder, open to logged-out visitors | The file is missing, edited, or redirects to another domain. |
| HTML tag | No | A meta tag in the head section of the logged-out homepage | The tag is missing, misplaced, or clashes with another user's tag. |
| Google Analytics tracking code | No | Edit rights, the same Google account, and the code in the head section | No code found, an old snippet, or the code sits in the wrong place. |
| Google Tag Manager | No | Publish or Admin permission, the same Google account, and the noscript part right after the body opens | No container found on the homepage, or your account lacks rights to it. |
| Domain name provider | Yes, and it is the only way | A login at your domain name provider to add a TXT or CNAME record | The record is not found yet, or it does not match. |
For Google Sites, the same Help page says new sites made since 2017 without a custom domain use the Google Analytics method, while new Blogger blogs verify automatically.
What should you try first on WordPress, Shopify or Wix?
Search your host's help pages before you touch any file or tag. Google's Help page on verifying ownership tells you to search your site host's documentation for Search Console verification information first. It also says Site Kit "is the only plugin that is officially sponsored by Google," so check any other plugin with care before you install it.
The page names WordPress, Wix and Squarespace as hosts where some methods may not work, while a plugin or setting may do the job for you. On WordPress, the page says Site Kit can handle verification for you, and our guide to fixing the WordPress SEO defaults covers the archive and plugin settings to check next. On Shopify, read our guide to what the Shopify theme will not fix.
Why does Search Console verification fail?
Search Console verification can fail when Google cannot reach your token or finds the wrong one. Google's Help page on verifying ownership names many causes, among them a file that redirects to another domain, a tag outside the head section, a login wall, and a slow server. Fix the cause, then click Verify again.
The page is not consistent on file redirects. Its steps say they are not followed. Its error notes say the file method follows redirects within the same domain, such as http to https, but not to another domain such as foo.com. The safe choice is a file that loads with no redirect at all. Tag methods check the page a logged-out visitor lands on, so if example.com sends people to example.com/home, the tag goes there. Other causes are server errors, such as timeouts, DNS lookup errors, too many redirects, or a password wall. Our guide to HTTP status codes explains the codes behind some of these errors, and our redirects and site migration playbook covers redirect chains. One error is serious: a "Hacked verification file" message means, per the Help page, that your site might have been hacked.
What can owners, full users and restricted users each do?
Owners have full control, full users can see all data and take some actions, and restricted users can view most data. Google's Help page on users and permissions also lists associates, who cannot open your Search Console data but can act for your site in places such as the Chrome Web Store. Only owners can grant access to anyone.
Every row in this table is taken from the permission table on Google's Help page about owners, users and permissions.
| Task | Owner | Full user | Restricted user |
|---|---|---|---|
| Add or remove owners | Yes | No | No |
| Add users | Yes | No | No |
| Link a Google Analytics account | Yes | No | No |
| Change of Address | Yes | View only | View only |
| Submit a sitemap | Yes | Yes | No |
| Disavow links | Yes | Yes | No |
| Remove URLs | Yes | Yes | View only |
| URL Inspection | Yes | Yes | Fetch only |
| Verify fixes | Yes | Yes | No |
| Performance report | Yes | Yes | Yes |
Before you hand a full user the disavow option, read our backlink audit guide on when to disavow at all.
How is a verified owner different from a delegated owner?
A verified owner proved control with a token, such as a file or tag on the site, while a delegated owner was added by a verified owner with no token. Google's Help page on users and permissions says both have the same rights. The catch is removal, because a verified owner cannot be downgraded, only removed.
Google's Help page on users and permissions caps a property at 100 non-owners. The same Help page lets you add delegated owners until verified and delegated owners reach 500 in total, while verified owners have no cap. My advice is to keep at least two verified owners on two different methods, so one lost login or one redesign cannot strand you.
How should you give an agency access to Search Console?
Give the least access that still lets the agency do the job. In my view, that means full user for the agency and restricted user for bosses who only read reports, with delegated owner only if the agency must add users. Google's Help page on users and permissions says to open Settings, then Users and permissions, and click Add user.
Then enter the person's Google Account email, choose a role and save. Before you sign, our guide to hiring an SEO agency explains why account ownership belongs in the contract. For the bosses with restricted access, our guide to SEO reporting KPIs that prove ROI shows which numbers matter.
How do you remove an owner so they cannot get back in?
Click Remove access, then delete every token that person left behind. Google's Help page on users and permissions warns that removing an owner does not delete their tokens, so that person can verify again while a token stays. Open Unused ownership tokens to see what is left, and check Ownership history for past changes.
Take care, because the page warns that one token can also serve Merchant Center or Google Workspace. If you run product feeds, our Google Merchant Center feed guide covers feed rules and disapprovals. A Google Analytics tag can double as a token, so never strip it out just to remove one person. That tag also feeds the reports in our guide to tracking AI referral traffic in GA4.
What if your only verified owner leaves or a stranger shows up?
If your only verified owner leaves, verify ownership yourself to keep or regain access. Google's Help page on users and permissions says that if all verified owners are removed, everyone else loses access after a grace period, though data is still collected. An owner you do not recognize is worse, and the page warns "you might have been hacked" in that case.
The same page adds that a hacker "can probably add their token back" after you remove it, so secure the site first. Our guide to checking whether your site is blacklisted is a sensible next stop. Manual actions are a separate problem, covered in our recovery guide for Google manual actions.
What should you check in Search Console this week?
Open Settings, then Users and permissions, and read every name on the list. Remove anyone who has left, then open Unused ownership tokens and Ownership history. Finally, add a second verification method, so your Search Console verification can survive the next redesign. It is a small job that can save you a lost Monday.
Back in Austin, that is how the agency would start its Berlin project, with an access audit before any audit of rankings. I expect Search Console verification to stay strict, because owners hold real power over a site on Google Search. So who on your team could prove ownership today if they had to?
Frequently asked questions about Search Console verification
Does adding or verifying a property change my rankings?
No, and Google's Help page on adding a property puts it plainly: "Adding a property does not affect your website" on Google Search. It only lets you track how your site performs. The page also says a setup you do not finish in one sitting will not hurt your website. So there is no ranking reason to rush, and the real reason to move fast is access, because you cannot fix what you cannot see. Verify early, then take your time on the rest.
Does Search Console collect data before verification?
Yes, because Google's Help page on adding a property says collection starts as soon as anyone adds the property, even before it is verified. Data should begin to appear in a few days. If you see no data several days after you verify, the page points to two causes. Either Google has not seen the site yet, or you chose the wrong address, such as http instead of https. For a fresh launch, our guide to ranking a brand-new domain covers what to measure first.
Can several people verify the same property?
Yes, and Google's Help page on verifying ownership says several people can verify the same property with the same method or different ones. Each person typically gets their own token, tied to their own account. If two people use the same method, take care not to overwrite each other's tokens, for example by pasting over a tag. I like this setup, because each person's Search Console verification stands on its own. When one of them leaves, you remove that person and their token, and nobody else is affected.
Do child properties need their own verification?
No, because once you verify a property, Google's Help page on verifying ownership says any child property you add gets the same Search Console verification method as the parent. If you verified example.com with an HTML file, then m.example.com or a folder path under it would use that same file. This makes it cheap to add country folders or a mobile subdomain later. The reverse does not work, though, because a child domain never verifies its parent, and it holds no data about the parent either.
How many properties can one Search Console account hold?
Google's Help page on adding a property says you can have up to 1,000 properties in your account. That leaves plenty of room for a Domain property plus a URL-prefix property for each country folder you run. The same page says you can type a domain with non-Latin letters, such as bücher.example.com, as you normally would, and it will display correctly. My advice is to name a clear owner for each property before the list grows, because a long list hides orphan properties.
Can I add a team email group as a user?
No, because Google's Help page on users and permissions says an email group cannot be added as a user, and every user needs a valid Google Account. That rule is annoying for agencies, but I think it helps, because each person shows up by name, so you can see who has access and remove them one by one. Add each team member on their own, give them the lowest role that works, and review the list whenever someone joins or leaves the team.
Why can some people only be added as an owner?
You may see the error "This user may only be added as 'Owner'," when you try to add someone. Google's Help page on users and permissions says this means the person already owns a property that contains this one, so they hold owner rights here too. Adding them as a full or restricted user would be a demotion, which is not allowed. If that feels like too much power, I would review who owns the parent property first, since that is where the rights come from.
How do I delete a token for each verification method?
Google's Help page on users and permissions lists each case. Delete the person's HTML file from the site root, their tag from the homepage source, or their DNS record at your provider. For Google Analytics, switch accounts or revoke that person's edit rights, and for Google Tag Manager, switch accounts or remove their Publish or Admin permission. For Google Sites or Blogger, the site owner must be switched. Remove only the token that belongs to the person you are removing, since other owners may rely on theirs.
Can I re-add a property I removed by mistake?
Yes, and Google's Help page on adding a property says you can re-add a removed property without verifying again, as long as it still has one verified owner. You simply add it the usual way, and you should be verified again automatically. If you are halfway through a new setup, the Verify later button saves your progress so you can finish on another day. Both rules make small mistakes cheap to undo, which is one more reason to keep two verified owners in place.
Does Search Console work for Instagram, TikTok or YouTube?
Yes, in part, because Google's Help page on adding a property describes platform properties for accounts or channels on Instagram, TikTok, X and YouTube. They track how that content performs on Google Search, and you connect one through an existing website property or by logging in to the platform. The page also says "We’re rolling out this feature gradually, so it might not be available to everyone yet," so do not panic if you cannot see it. Website properties remain the core of the job.