Blog

  • Web Design Company in India: What US Businesses Should Know Before Hiring One

    Web Design Company in India: What US Businesses Should Know Before Hiring One

    Hiring a web design company in India can make excellent business sense for a US company.

    But the decision should not begin with one question:

    “How much cheaper is an Indian web design company?”

    A better question is:

    “How well will this company understand my business, and how responsibly will they build and manage my website?”

    After more than 25 years working across web design, development, SEO and digital strategy-and working with international clients since the early 2000s-I have learned that the difference between a successful website project and a frustrating one rarely comes down to geography.

    It comes down to how the people behind the project think.

    So, rather than writing another generic guide about hiring an offshore web development company, I wanted to answer a more practical question:

    What should a US business actually expect from a serious web design company in India?

    Start With the Business, Not the Website

    When a client tells me, “We need a new website,” I don’t immediately start discussing colors, technology, pages or animations.

    I want to understand why they need the website in the first place.

    Is the website simply going to establish an online business presence?

    Is it expected to generate leads?

    Is the company trying to grow locally, nationally or internationally?

    Is it selling products online?

    Does the business need ecommerce, bookings, memberships, subscriptions or some other functionality?

    Then I want to understand the business itself.

    What products or services does it offer?

    What are its current challenges?

    Who are its customers?

    Are there competitors the client particularly likes?

    And if they like a competitor’s website, what exactly do they like about it?

    This conversation establishes the foundation for everything that comes afterward.

    A corporate coach, for example, might say:

    “I need a modern website for my corporate coaching business.”

    That could mean a relatively straightforward business website.

    Or it could mean a much larger platform involving online education, memberships, payments, scheduling, courses and ecommerce.

    The sentence is the same.

    The project isn’t.

    That’s why requirements cannot always be extracted from a form. Sometimes the client knows exactly what they need. Sometimes they need guidance to discover what they actually need.

    A good web consultant should be comfortable doing both.

    For more on this philosophy, see our approach to web design and development.

    A Website Is Not the Objective

    This is probably the most important principle I have developed over the years:

    The website is not the objective.

    The website is a tool.

    The real objective might be generating qualified enquiries, selling products, attracting applicants, establishing credibility, supporting an existing sales process, educating customers, or creating an online platform around the business.

    That changes how the website should be designed.

    A beautiful website that doesn’t help the business achieve its objective is still a poor business investment.

    This is also why I don’t believe in starting every project with a predetermined technology stack.

    First understand the business.

    Then determine what the website needs to accomplish.

    Then decide what needs to be built.

    And only then decide how it should be built.

    Don’t Judge a Website by Its Looks Alone

    I enjoy good design. I care about colors, typography, interface design, animations, spacing, imagery and visual polish.

    But a website can look fantastic and still perform badly.

    Website design connected to business goals, leads and conversions
    A website is a business tool – not the business objective itself.

    Google doesn’t care whether a website uses black or white backgrounds. Users don’t visit a website because it has a particular glassmorphism effect.

    They visit because they need something.

    They want information.

    They are comparing options.

    They want to know whether they can trust the business.

    Or they are ready to buy.

    The first few seconds matter enormously.

    A visitor should quickly understand:

    What does this company do?

    Is this relevant to me?

    Can I trust this company?

    What should I do next?

    That is why I think of the websites we build as conversion-focused from the ground up.

    The visual design should support the communication rather than distract from it.

    SEO Should Begin Before the First Line of Code

    One of the biggest misconceptions about web design is that SEO is something you “add” after the website has been built.

    I don’t see it that way.

    SEO is active before the first character of code is written.

    Before development begins, we think about the website’s architecture.

    The homepage.

    Services.

    About.

    Blog.

    Legal pages.

    Breadcrumbs.

    Internal linking.

    Structured data where relevant.

    URL structure.

    Content architecture.

    Performance.

    Search intent.

    The technical foundation matters because search engines need to understand what a website is about and how its pages relate to each other. Google itself provides extensive guidance around search visibility, technical requirements and Search Essentials.

    This is also why we don’t sell “SEO-friendly development” as some magical add-on.

    The websites we build are designed with search in mind by default.

    That doesn’t mean we promise rankings.

    It means we don’t intentionally build a website in a way that creates unnecessary obstacles for search engines.

    Performance matters too. Google’s Web Vitals initiative focuses on user experience signals around loading, interactivity and visual stability, including the Core Web Vitals.

    So our approach is performance-first rather than adding performance optimization as an afterthought.

    And no, that doesn’t mean filling the website with AI-generated content simply because AI can produce thousands of words.

    Don’t Destroy an Existing Website’s SEO Value During a Redesign

    An existing website is a very different project from a new website.

    I take redesigning an old website very seriously.

    Why?

    Because an established website may have years of accumulated search visibility, backlinks, indexed URLs, content, references and user familiarity.

    You cannot simply dismantle it and start again as though nothing existed before.

    Before the old website is replaced, there should be a proper migration plan.

    Which pages are important?

    Which URLs have search visibility?

    Which pages should remain?

    Which URLs are changing?

    What happens to old content?

    Where should old URLs point?

    If an old URL such as:

    example.com/?page=06

    is being replaced by a meaningful URL such as:

    example.com/services/consulting

    the migration needs to account for that change.

    Website redesign migration with old URLs mapped to new URLs using redirects
    A website redesign should protect the search visibility and URL equity accumulated by the existing site.

    Permanent redirects are an important part of a migration. Google specifically recommends permanent server-side redirects such as 301 or 308 when a page has permanently moved.

    The principle is simple:

    A redesign should improve the website without accidentally destroying the digital value that already exists.

    This is one reason our website investigations often look far beyond the current visual design. A website has a history.

    And that history matters.

    For example, our investigation into a long-running website’s SEO, UX and URL changes illustrates why seemingly technical decisions can have consequences well beyond the design itself.

    Technology Should Follow the Business

    There is a temptation in web development to choose technology because it is new, fashionable or technically impressive.

    I don’t think that is a good reason.

    Suppose a small business needs a few pages:

    • Home
    • About
    • Services
    • Contact
    • Legal pages

    There may be no reason to build a complicated custom platform.

    A standard CMS such as WordPress may be perfectly appropriate.

    Now change the requirement.

    Suppose the client needs a custom car-rental booking system with functionality that standard CMS plugins cannot reasonably provide.

    That changes the technology decision.

    Or imagine a business wants to create a gemstone marketplace where users can register, verify accounts and list gemstones for sale.

    Now we’re talking about a much more sophisticated platform involving users, listings, verification, ecommerce and business-specific workflows.

    The technology should reflect that requirement.

    The newest technology is not automatically the right technology.

    Experience is partly knowing what you can build.

    But it is also knowing what you don’t need to build.

    Conversion Doesn’t Mean “Put a Contact Button Everywhere”

    Websites receive different types of visitors.

    I generally think about three broad categories.

    Type 1: “I’m learning.”

    The visitor is researching a product, service or problem.

    A useful blog can help this person understand the subject and discover the business.

    Type 2: “I’m comparing.”

    This person already understands the product or service and is looking at different options.

    This visitor needs detailed, credible service or product information.

    They need to understand what the company offers, why it matters, what makes it different and whether it appears trustworthy.

    Type 3: “I’m ready.”

    This person is ready to buy, enquire, book, sign up or take the next step.

    The website should make that next step obvious.

    The mistake is designing the entire website around Type 3.

    Not everybody is ready to contact you immediately.

    A good website creates useful doors for all three.

    Educate the first visitor.

    Help the second visitor evaluate you.

    Make it easy for the third visitor to act.

    When those first two layers are done properly, the third becomes much more natural.

    A Website Should Represent the Real Business

    A website is, in many ways, the digital mirror of a physical business.

    And this creates an interesting problem.

    Over 25 years, I have seen all kinds of businesses.

    There are businesses that are genuinely excellent but have websites that badly underrepresent them.

    And there are businesses that are not nearly as impressive as their websites make them appear.

    A website should not manufacture credibility that doesn’t exist.

    It should communicate the genuine credibility that does.

    That means accurate information.

    Real experience.

    Good products or services.

    Authentic testimonials and reviews where appropriate.

    Clear information.

    Professional presentation.

    Useful content.

    And a straightforward way for a potential customer to contact the business.

    For businesses marketing to US consumers, truthfulness matters beyond SEO. The Federal Trade Commission states that advertising claims should be truthful, non-deceptive and supported by evidence.

    Our job is not to make a mediocre business look extraordinary.

    Our job is to present a genuine business properly.

    Talk to the People Behind the Website

    If you’re considering several web design companies in India, don’t evaluate them entirely through email.

    Have a video call.

    Look at the portfolio, certainly.

    Read the case studies.

    Read their published articles.

    Look at their reviews.

    But then talk to the people.

    You will learn things from a conversation that you cannot learn from a portfolio.

    Do they listen?

    Do they ask questions?

    Are they genuinely interested in your business?

    Do they challenge your assumptions when necessary?

    Do they understand what you’re trying to accomplish?

    Or are they simply trying to get you to approve a proposal?

    Anybody can have a good-looking website these days.

    The harder thing to manufacture is genuine involvement.

    I have always believed that asking unusual questions can sometimes be a sign that someone is actually trying to understand your business rather than simply collecting requirements.

    A Consultant Should Be Willing to Say “No”

    If a client comes to me with a specific idea and, after understanding the business, I believe that idea isn’t appropriate, I believe it is my responsibility to say so.

    Politely, of course.

    But honestly.

    Otherwise, why call yourself a consultant?

    A consultant shouldn’t simply execute every request without thinking.

    The responsibility is to tell the client what appears to be good, what appears problematic, and why.

    Sometimes that means recommending something different from what the client initially asked for.

    Sometimes it means recommending a smaller project.

    And sometimes it means saying:

    “You don’t actually need this.”

    That last sentence might mean less revenue for the agency.

    That’s okay.

    I would rather lose a project than sell something a client doesn’t need.

    Ownership Should Stay With the Client

    There is another principle I feel very strongly about:

    The client should own their website.

    The client is paying for their work.

    A website isn’t a SaaS subscription where the agency owns the underlying business asset.

    The client should have control over the important components of their digital presence, including where applicable:

    • Domain
    • Hosting
    • Website
    • Source code
    • CMS/admin access
    • Google Analytics
    • Google Search Console
    • Relevant licenses
    • Other accounts and services paid for by the client
    Business owner controlling website domain hosting source code and analytics
    A professional web agency should build trust—not hold a client’s digital assets hostage.

    I strongly dislike the practice of holding a client’s domain, hosting or website access hostage so that the client has to keep paying the original agency for every modification.

    That may create recurring revenue.

    It doesn’t create trust.

    Give the client control.

    Then earn their continued business because they want to work with you.

    Working With an Indian Web Company From the US: Communication Matters

    My experience working with US clients goes back to 2003, when I began working with a Los Angeles-based web design company on SEO projects.

    One of the earliest lessons I learned was about punctuality.

    A 4:00 PM meeting meant 4:00 PM.

    Not 4:10.

    Not 4:15.

    That may sound trivial, but it taught me something much bigger:

    Professional expectations are not universal.

    Different markets can have different expectations around time, communication, responsiveness and accountability.

    If an Indian company wants to work seriously with US clients, these things cannot be treated casually.

    Be punctual.

    Communicate clearly.

    Take ownership.

    If there is a problem, say so.

    If a deadline is at risk, communicate before the deadline – not after it.

    And understand that the client is not simply buying technical work.

    They are buying a working relationship.

    Don’t Accept Projects You Cannot Deliver

    This is another area where I think the industry has a serious problem.

    Some companies accept projects before they are genuinely confident they can deliver them.

    The invoice gets raised.

    The client pays.

    Then the company figures out how to execute the project afterward.

    Sometimes parts of the project are outsourced to freelancers.

    Something goes wrong.

    The client doesn’t know who actually did the work.

    But the agency is still responsible.

    I don’t believe that’s ethical.

    A web design company should accept projects that it is genuinely capable of delivering.

    It is better to lose a project than accept money for work you aren’t equipped to execute properly.

    And if something unexpected happens during a project, there is an important distinction.

    If the client changes the scope or requests significant new functionality, that can affect the timeline and cost. Discuss it transparently.

    If the problem is a bug caused by the agency’s own work, that’s different.

    Own it.

    Fix it.

    Don’t make the client pay for your mistake.

    What Happens After the Website Goes Live?

    We don’t really call it “finished.”

    We call it handover.

    The website goes live, the appropriate analytics and Search Console setup is completed, and depending on what the client has signed up for, the project moves into its next phase.

    All website projects should also account for bug fixing. Bugs resulting from the development work are part of delivering the project properly.

    Beyond that, maintenance depends on the website.

    A simple business website and a complex ecommerce platform obviously have very different maintenance requirements.

    But I don’t think businesses should assume that websites are maintenance-free.

    Think of it like a car.

    You don’t buy a car and assume it will never need maintenance again.

    A website is no different.

    Website maintenance compared with regular maintenance of a business asset
    Like any important business asset, a website needs appropriate maintenance after launch.

    Software changes.

    Browsers change.

    Security requirements change.

    Third-party services change.

    Content changes.

    Business requirements change.

    A website should be maintained according to its complexity and importance to the business.

    Quality Doesn’t Have to Mean the Same Price

    One of the reasons US businesses consider offshore web development is cost.

    That’s perfectly understandable.

    But I don’t think the conversation should be:

    “How cheap can I get a website from India?”

    The better question is:

    “Can I get the quality, communication, accountability and technical capability I need from an Indian team at a commercially sensible cost?”

    The lower invoice amount does not automatically mean lower quality.

    Indian companies operate in a different cost environment from companies in the United States. That can create a meaningful pricing difference while still allowing a capable team to deliver professional work.

    For the client, the real requirements are usually straightforward:

    Good quality.

    Clear communication.

    Timely delivery.

    Technical competence.

    Trust.

    Accountability.

    Those things matter regardless of where the web company is located.

    So, What Should a US Business Look For?

    There isn’t one universal checklist that determines whether an agency is right for every business.

    Different clients value different things.

    Some will care heavily about design.

    Some will care about case studies.

    Some will care about SEO experience.

    Some will look closely at reviews.

    Some will prioritize technology.

    Others will care most about communication.

    But there is one thing I would encourage every prospective client to do:

    Talk to the people behind the website.

    Ask questions.

    Explain your business.

    See whether they listen.

    Tell them what you think you need and see whether they simply agree – or actually think about it.

    Ask how they approach an existing website.

    Ask what happens to your URLs during a redesign.

    Ask who owns the domain and hosting.

    Ask how SEO is incorporated.

    Ask what happens when something goes wrong.

    Ask what happens after launch.

    And most importantly:

    Pay attention to whether they seem genuinely invested in understanding your business.

    Because that is difficult to fake over the course of an actual project.

    The Country Isn’t the Quality Filter. The Process Is.

    A good web design company in India doesn’t need to compete with US companies by pretending to be a US company.

    It needs to compete on what actually matters:

    Understanding the business.

    Listening before speaking.

    Asking difficult questions.

    Choosing appropriate technology.

    Building with search and performance in mind.

    Protecting existing digital assets.

    Designing around user intent.

    Giving clients ownership.

    Communicating honestly.

    Taking responsibility.

    And knowing when to say, “This isn’t what you need.”

    After more than two decades in this industry, my philosophy has become surprisingly simple.

    I don’t believe the goal is to sell the client the biggest website possible.

    I don’t believe every project needs the newest technology.

    I don’t believe SEO should be bolted onto a website after development.

    I don’t believe a beautiful interface automatically means a successful website.

    And I certainly don’t believe a client should be trapped by the company that built their website.

    Understand the business.

    Solve the right problem.

    Build what is actually needed.

    Protect what already exists.

    Give the client control.

    And deliver honestly.

    That is what I believe a professional web design company – whether in India, the United States, or anywhere else – should do.


    A note on standards and usability

    There is also a broader technical responsibility that shouldn’t be overlooked. Web accessibility is an international web standard, with W3C’s WCAG 2.2 providing guidelines around making web content accessible to people with disabilities.

    Accessibility, performance, search visibility, usability and conversion aren’t isolated disciplines. They overlap.

    And that is ultimately why I don’t look at a website as merely a collection of pages.

    I look at it as a business asset.

    If you are considering a new website, redesign or custom web development project, you can learn more about our web design approach or contact Web Design India to discuss what your business actually needs.

  • Negative SEO Canonical Hack: How It Works

    Negative SEO Canonical Hack: How It Works

    Imagine this.

    You publish an important page on your website. It has been ranking well for months. Then one day, you search for the page on Google and discover something strange.

    Another domain is showing your title, your description, your URL structure and almost your entire page content.

    You click the result.

    Instead of seeing the copied page, you are suddenly redirected somewhere else.

    Your own website has not been hacked. Your server looks fine. Your CMS looks fine.

    So what the hell is going on?

    This is the kind of situation I encountered while working at The Search Agency, and it led us down a rather unusual SEO investigation involving scraped content, compromised websites, redirects, user-agent detection and canonical signals.

    The technique is often described as a negative SEO canonical hack.

    The important thing to understand, however, is that a canonical tag is not a magic switch that lets someone simply tell Google, “Ignore this website and rank mine instead.” Google treats canonical declarations as signals, not commands.

    But Google does explicitly document malicious attacks involving cross-domain canonical tags and redirects, and says its systems may, in some circumstances, select the malicious or spammy URL instead of the URL on the compromised website.

    So let’s look at what this attack actually looks like, how we encountered it, how you can investigate one today, and what has changed since the original case.

    What Is a Negative SEO Canonical Hack?

    Diagram showing how a negative SEO canonical hack works, with content scraped from a legitimate website, published on a compromised site, crawled by Googlebot, and human visitors redirected to another website.
    A visual overview of a negative SEO canonical hack, showing how scraped content on a compromised website can be exposed to search engines while human visitors are redirected to a different destination.

    A negative SEO canonical hack is a term used to describe an attack in which an attacker tries to manipulate how search engines understand the relationship between your original content and a copied version hosted elsewhere.

    A typical scenario can involve:

    1. Your content being scraped.
    2. A vulnerable third-party website being compromised.
    3. Your content being published on that compromised website.
    4. Canonical or redirect signals being manipulated.
    5. Search engines being shown the copied content.
    6. Human visitors being redirected somewhere else.

    The goal is generally to interfere with search engines’ understanding of which URL represents the original content.

    There is an important distinction here.

    A canonical tag is only one signal.

    Google says that canonicalization involves multiple signals, including redirects, sitemaps and rel="canonical" annotations. Google ultimately chooses the canonical URL algorithmically. A site owner’s declared canonical is not guaranteed to be selected.

    That means seeing an external canonical URL is not automatically proof of a negative SEO attack.

    It is a reason to investigate.

    How a Negative SEO Canonical Hack Works

    Illustration showing original website content being copied by an attacker as part of a negative SEO canonical hack.
    Step 1 and 2: Your website publishes original content, which is then scraped and copied by an attacker.
    Illustration showing copied content published on a compromised website, with search engines seeing manipulated signals while human visitors are redirected elsewhere.
    Step 3 and 4: Copied content is placed on a compromised website, exposing search engines to manipulated signals while visitors may be redirected to another site.

    The easiest way to understand the concept is to follow the attack from beginning to end.

    1. Your website is crawled and your content is copied

    The attacker first obtains content from the target website.

    This could include:

    • Page titles
    • Meta descriptions
    • Headings
    • Body content
    • URL structures
    • HTML
    • Images
    • Internal links
    • CSS
    • Other page elements

    The attacker may not need access to your website at all.

    This is an important point.

    Your website can remain completely secure while your content is being used in the attack.

    2. The attacker finds a vulnerable website

    The attacker then looks for another website with a security vulnerability.

    It might be an old CMS installation, an outdated plugin, compromised hosting account or another poorly secured website.

    The attacker gains control of the site and uses it as an intermediary.

    I call this the middleman website because it sits between the original website and whatever destination the attacker ultimately wants the visitor to reach.

    3. The copied content is published on the compromised website

    The attacker creates pages on the compromised website containing copies of your content.

    The URLs may even imitate the structure of the original website.

    For example:

    Original websiteCompromised website
    example.com/services/web-design/randomsite.com/?join=/services/web-design/
    example.com/about-us/randomsite.com/?join=/about-us/
    example.com/blog/seo-guide/randomsite.com/?join=/blog/seo-guide/

    The exact URL structure can vary.

    The important part is that the attacker is trying to make the copied page look sufficiently similar to the original page for search engines to treat the two as related or duplicate content.

    4. Canonical signals are manipulated

    This is where the canonical aspect comes into play.

    A canonical annotation tells search engines which URL a page owner considers to be the preferred version among duplicate or very similar URLs.

    For example:

    <link rel="canonical" href="https://example.com/original-page/" />

    Google describes rel="canonical" as one of the signals it considers when determining which URL should be treated as canonical. It is not an absolute instruction.

    In a malicious scenario, an attacker may inject a cross-domain canonical or other signals into the compromised website.

    Google specifically documents malicious attacks where hackers inject a cross-domain rel="canonical" annotation or an HTTP 3xx redirect, potentially causing Google’s systems to select the malicious or spammy URL instead of the URL on the compromised website.

    That is considerably more nuanced than saying:

    “Someone adds a canonical tag and Google automatically deindexes your website.”

    That is not how Google’s current documentation describes canonicalization.

    5. Googlebot and human visitors may see different things

    This is another particularly interesting part of the attack.

    The compromised page may be configured so that:

    • Googlebot receives the copied content.
    • A normal visitor receives a redirect.
    • Visitors arriving from Google may be treated differently.
    • Certain devices or referrers may receive different responses.

    This type of behavior falls into the broader category of cloaking when it is deliberately used to show different content to search engines and users for ranking manipulation. Google also notes that hacked websites commonly use cloaking and user-agent or referrer-dependent redirects.

    So the page you see in your browser may not be the same page Google encounters.

    And that’s where these investigations can get really weird.

    A Simple Example of the Attack

    Here’s the conceptual flow:

    Your website

    ↓
    Your content is scraped

    ↓

    Compromised third-party website

    ↓
    Copied version of your page is published

    ↓
    Canonical / redirect / other signals are manipulated

    ↓

    Google crawls the compromised page

    Meanwhile:

    Human visitor

    ↓
    Visits the compromised URL

    ↓
    JavaScript or server-side redirect

    ↓

    Attacker’s destination website

    The compromised website is effectively being used as a technical middleman.

    IMAGE SUGGESTION

    I strongly recommend creating one custom diagram for this section.

    A simple 4-column or horizontal flow diagram would make this article much easier to understand:

    Your Website → Scraped Content → Compromised Middleman → Google

    And underneath the middleman:

    Googlebot → copied page / manipulated signals

    Human visitor → redirect → destination website

    This is much more useful than a generic “SEO hacking” stock image.

    Our Experience With a Negative SEO Canonical Hack

    This is where the subject became particularly interesting for me.

    While working at The Search Agency, we noticed something unusual in Google’s search results for a client.

    This was one of the kinds of technical SEO investigations that shaped how I approach website problems today.

    I’ve spent more than two decades working across SEO, web development and digital marketing, so I’ve learned to look beyond the obvious symptom when something goes wrong.

    The client’s own page appeared to have been replicated somewhere else.

    But this wasn’t just an ordinary scraper.

    The strange part was the combination of signals.

    The unfamiliar domain was showing:

    • The same page title
    • A very similar description
    • The client’s directory structure
    • The client’s content
    • A page that looked like a copy of the client’s website

    Yet when the unfamiliar result was clicked, the visitor was redirected elsewhere.

    That immediately raised questions.

    Was the client’s website hacked?

    Was Google seeing a different version of the page?

    Was the other domain simply scraping the site?

    Or was something more deliberate happening?

    We started investigating.

    The Client’s Website Had Not Been Hacked

    This distinction turned out to be extremely important.

    The target website itself wasn’t compromised.

    Its content had been copied.

    The compromised website was somewhere else.

    That gave us a situation that looked roughly like this:

    ComponentWhat happened
    Client websiteNot hacked
    Client contentScraped
    Third-party websiteCompromised
    Copied contentPublished on compromised website
    Search enginesExposed to the copied version
    Human visitorsRedirected
    Other suspicious linksAlso discovered during investigation

    This is one of the reasons these attacks can be difficult to diagnose.

    A website owner naturally starts by asking:

    “Has someone hacked my website?”

    Sometimes the answer is no.

    The attack may be happening around your website rather than inside it.

    We Found the Same Page Structure on Another Domain

    One of the clues was the unusual similarity between the client’s legitimate URL structure and the URLs appearing on the unfamiliar domain.

    The pages weren’t simply generic copies.

    The URL patterns themselves appeared to be constructed around the client’s directory structure.

    That made the situation much more suspicious.

    We investigated the HTML and discovered that the page being served to search engines contained a copy of the client’s content.

    The page also behaved differently depending on who was requesting it.

    A normal visitor could be redirected while a search-engine crawler could encounter the copied content.

    That behavior is particularly important because Google explicitly recognizes user-agent, referrer and device-dependent redirects as something that can occur with hacked websites.

    We Found More Than One Compromised Website

    The investigation didn’t stop with a single domain.

    We found additional compromised websites being used in a similar way.

    At that point, it became clear that this wasn’t simply a random website scraper copying a few paragraphs of content.

    There was a broader pattern involving:

    • Scraped content
    • Compromised websites
    • Search-engine crawling
    • Redirect behavior
    • Canonical signals
    • Suspicious backlinks

    That combination is what made the case particularly interesting.

    Did the Canonical Hack Cause the Traffic Drop?

    This is where I would be careful with the wording today.

    The original investigation showed a significant traffic decline around the period in which the suspicious activity was discovered.

    That made the attack an important part of the investigation.

    But an SEO traffic chart by itself does not prove that a specific canonical manipulation caused every part of the decline.

    Search traffic can fall for many reasons:

    • Algorithm changes
    • Technical problems
    • Indexing changes
    • Competition
    • Seasonality
    • Website changes
    • Manual actions
    • Security problems
    • Content changes
    • Canonicalization problems

    So if you encounter a similar situation, treat the traffic decline as a symptom, not automatically as proof of causation.

    That’s an important lesson from looking back at older SEO investigations with today’s understanding.

    Does a Negative SEO Canonical Hack Still Work in 2026?

    The short answer is: the underlying type of attack is still relevant, but you should not assume the old mechanism works exactly as it did years ago.

    Google’s current documentation explicitly discusses malicious hacking involving:

    • Cross-domain rel="canonical" annotations
    • HTTP 3xx redirects
    • Malicious or spammy destination URLs

    Google says its algorithms may choose the malicious or spammy URL instead of the URL on the compromised website in these circumstances.

    At the same time;

    Google makes it clear that canonicalization is algorithmic. A canonical tag is a signal, not a command.

    Google explains the canonicalization process in more detail in its documentation on how it selects a representative URL from duplicate pages.

    Google considers multiple signals when choosing a canonical URL, and its selected canonical can differ from the URL declared by the site owner.

    So I would not describe the attack as:

    “Put a canonical on another website and Google will automatically remove your page.”

    That’s far too simplistic.

    A better description is:

    An attacker may attempt to manipulate Google’s canonicalization and indexing signals by placing copied content and malicious canonical or redirect signals on a compromised third-party website.

    That is both more accurate and more useful.

    How to Detect a Possible Canonical Attack

    If you suspect that someone is trying something unusual with your content, don’t start by panicking.

    Start collecting evidence.

    Conceptual Google Search Console illustration showing different user-declared and Google-selected canonical URLs.
    URL Inspection can reveal when Google selects a different canonical URL from the one declared on your page.

    1. Check Google Search Console URL Inspection

    This is probably the first place I would look.

    Google Search Console’s URL Inspection tool lets you examine the indexed version of a URL and, among other things, see the user-declared and Google-selected canonical.

    Look at:

    • Indexing status
    • User-declared canonical
    • Google-selected canonical
    • Last crawl
    • Crawled page
    • Rendered page
    • JavaScript output where relevant

    Google’s URL Inspection tool specifically provides the User-declared canonical and Google-selected canonical fields. Google also warns that the live test cannot predict canonical selection because canonicalization is determined from indexed data.

    If Google has selected an unexpected external URL, that deserves investigation.

    It does not, by itself, prove that you’ve been attacked.

    Google also documents situations involving malicious hacking, cross-domain canonical annotations and redirects, so an unexpected external canonical is worth investigating rather than simply ignoring.

    2. Search for exact sentences from your page

    Take a distinctive sentence from the affected page and search for it in Google using quotation marks.

    For example:

    "your unique sentence from the page"

    Try several distinctive sentences.

    You can also use searches such as:

    site:example.com "unique sentence"

    and search without the site: restriction to discover copies elsewhere.

    If you find dozens or hundreds of copies, you may be dealing with ordinary scraping.

    If you find a small number of highly unusual copies combined with redirects, manipulated canonicals or hacked domains, investigate further.

    3. Check whether Google selected another canonical

    This is one of the most important checks.

    Suppose your page is:

    https://example.com/services/web-design/

    But Search Console reports a Google-selected canonical such as:

    https://strangedomain.com/?page=web-design

    That is worth investigating.

    Google’s documentation specifically says that the Google-selected canonical can differ from the user-declared canonical, and the URL Inspection report is where you can see that selection.

    Again, unexpected does not automatically mean malicious.

    You need to examine the competing page and the signals around it.

    4. Inspect your actual HTML

    Check the source code of the affected page.

    Look for:

    <link rel="canonical" ...>

    Also inspect:

    • HTTP response headers
    • SEO plugin settings
    • CMS templates
    • Theme files
    • Server configuration
    • Redirect rules
    • JavaScript
    • Recently modified files

    You are trying to answer a simple question:

    Is my website declaring the wrong canonical, or is the strange canonical coming from somewhere else?

    5. Check for redirects

    Test the affected URLs from different situations.

    For example:

    • Direct browser visit
    • Google Search result
    • Different browser
    • Logged-in vs logged-out
    • Mobile vs desktop
    • Different referrer

    Be careful here.

    You don’t need to imitate an attacker. You are simply trying to establish whether the URL behaves differently under different conditions.

    Google specifically documents hacked redirects that can vary according to referrer, user agent or device.

    6. Check your backlinks

    Open the Links report in Google Search Console and look for unusual domains or patterns.

    Google’s Links report can show sites linking to you, although Google describes it as a sample rather than a comprehensive list of every backlink.

    Look for patterns such as:

    • Large numbers of unrelated domains
    • Hacked-looking websites
    • Strange anchor text
    • Links appearing suddenly
    • Links to unusual URLs
    • Repeated links from compromised websites

    But don’t make another common SEO mistake here:

    Don’t assume every strange backlink is causing your ranking problem.

    Google ignores many spammy links automatically.

    The existence of weird links and the existence of a canonical/indexing problem are two separate things that should be investigated separately.

    How to Fix a Canonical or Hacking Problem

    The correct response depends on where the problem actually exists.

    If Your Website Has Been Hacked

    Treat it as a security incident first and an SEO incident second.

    You should:

    1. Take appropriate containment steps.
    2. Change compromised passwords and credentials.
    3. Enable multi-factor authentication.
    4. Update your CMS, plugins and themes.
    5. Remove unauthorized users.
    6. Scan the website and server.
    7. Check modified files.
    8. Check the database.
    9. Inspect redirects.
    10. Check for injected JavaScript.
    11. Check Search Console for security issues.
    12. Review the site after cleanup.
    13. Request reindexing where appropriate.

    Google’s documentation notes that hacked websites can contain injected code, new spam pages, manipulated content and malicious redirects.


    If Your Website Was Not Hacked but Your Content Was Copied

    This is a different situation.

    You may need to:

    • Document the copied pages.
    • Record the URLs.
    • Record dates and screenshots.
    • Identify the hosting provider.
    • Contact the website owner if appropriate.
    • Contact the hosting provider if the site itself appears compromised.
    • Investigate copyright-removal options where applicable.
    • Report malicious behavior through appropriate Google channels.
    • Continue monitoring your own site.

    There is an interesting wrinkle here.

    The owner of the compromised website may also be a victim.

    If someone hacked a small business website and used it to copy your content, attacking the website owner may be the wrong response.

    They may have no idea what is happening.


    What About Disavowing the Links?

    This is an area where older SEO advice can become outdated very quickly.

    Finding suspicious links does not automatically mean you should rush to Google’s disavow tool.

    Google has repeatedly explained that many unnatural or spammy links are handled automatically.

    The important question is what role those links actually play in the problem.

    If you have a serious unnatural-link situation, particularly one involving links that were deliberately created for your site, investigate the circumstances before deciding whether disavowal is appropriate.

    Don’t turn:

    “I found weird backlinks”

    into:

    “I need to disavow 50,000 domains immediately.”

    Those are two very different conclusions.


    What If Google Has Selected the Wrong Canonical?

    This requires a slightly different approach.

    First, determine whether Google is actually seeing two substantially similar pages.

    Then compare:

    CheckWhat you want to know
    User-declared canonicalWhat does your site say is the preferred URL?
    Google-selected canonicalWhat URL did Google choose?
    Page contentAre the pages actually duplicates or very similar?
    RedirectsIs one URL redirecting to another?
    SitemapWhich URL are you submitting?
    Internal linksWhich version does your website consistently link to?
    External copyIs another domain hosting your content?
    Server responseIs the correct content being returned?

    Google’s own documentation recommends comparing the user-declared canonical with the Google-selected canonical when investigating canonicalization problems.

    The goal is not to force Google to accept a canonical tag.

    The goal is to make the overall set of signals unambiguous.

    How to Prevent This From Happening

    You can’t prevent somebody from copying content from a publicly accessible website.

    But you can make your own website considerably harder to compromise and much easier to monitor.

    That starts with getting the technical foundation right, from the CMS and hosting environment to redirects, canonical tags and overall site architecture.

    A properly planned website should treat these technical foundations as part of the build, not as an afterthought.

    Keep your website technically maintained

    At minimum:

    • Keep your CMS updated.
    • Keep plugins updated.
    • Remove abandoned plugins.
    • Remove unused themes.
    • Use strong unique passwords.
    • Enable MFA wherever available.
    • Limit administrator accounts.
    • Use reputable hosting.
    • Monitor unexpected changes.
    • Keep reliable backups.
    • Monitor Search Console.

    Security isn’t a one-time installation.

    It’s an ongoing process.

    Monitor more than just rankings

    Most website owners watch one thing:

    “What’s my ranking?”

    That’s useful, but it’s not enough.

    A better monitoring system watches several signals.

    What to monitorWhy it matters
    Organic trafficCan reveal sudden changes
    Search queriesShows changes in visibility
    Indexed pagesCan reveal unexpected pages
    Google-selected canonicalsCan reveal canonicalization anomalies
    Search Console security issuesCan reveal certain compromises
    BacklinksCan reveal unusual link activity
    Server logsCan reveal suspicious requests
    RedirectsCan reveal malicious behavior
    Website source codeCan reveal injected code
    Uptime/server errorsCan reveal technical problems

    Search Console’s reporting tools can help investigate indexing and search-performance changes, while URL Inspection provides page-level information about Google’s indexed version of a URL.

    The Biggest Lesson From This Case

    The most interesting thing about this type of attack isn’t actually the canonical tag.

    It’s the fact that your website doesn’t necessarily have to be hacked for somebody to create an SEO problem around it.

    Your content can be copied.

    Another website can be compromised.

    That compromised website can be used to host the copied content.

    Search engines can encounter manipulated signals.

    Visitors can be redirected somewhere else.

    And by the time you notice something is wrong, several different technical systems may be involved.

    That’s why SEO troubleshooting needs to go beyond:

    “My rankings dropped.”

    The better question is:

    “What changed, what is Google seeing, and what evidence can I find?”

    This is also something I’ve written about from the broader client-agency perspective: when you’re responsible for SEO performance, you need access to the technical information and control necessary to actually investigate what is happening.

    That’s the mindset that helped us investigate this case in the first place.


    Final Thoughts

    The phrase “negative SEO canonical hack” makes the attack sound almost like a secret weapon that can instantly steal somebody else’s rankings.

    Reality is considerably messier.

    Canonicalization is algorithmic. A rel="canonical" tag is a signal, not a guarantee. Google can choose a different canonical based on the broader set of signals it sees.

    At the same time, this isn’t just an SEO conspiracy theory.

    Google’s own documentation specifically describes malicious attacks involving cross-domain canonical annotations and redirects, including situations where Google’s systems may select the malicious or spammy URL instead of the URL on the compromised website.

    The practical lesson is simple:

    Don’t panic when you find a strange canonical. Investigate it.

    Check Search Console.

    Compare the user-declared and Google-selected canonicals.

    Look for copied content.

    Inspect redirects.

    Check your source code and server responses.

    Look for evidence of hacking.

    And most importantly, don’t assume that every strange SEO symptom has one obvious cause.

    Sometimes the most important clue isn’t on your website at all.

    Originally investigated while I was working at The Search Agency. This article has been updated for 2026 with current Google documentation and modern troubleshooting guidance.

  • The Accountability Trap: Client Wants Results. Consultant Gets Handcuffed.

    The Accountability Trap: Client Wants Results. Consultant Gets Handcuffed.

    What happens when a consultant is expected to deliver results without controlling the decisions, systems and execution that determine those results.

    There is a sentence that sounds perfectly reasonable in a business conversation:

    “I want results.”

    Of course you do.

    If you’re paying a web designer, SEO consultant, marketing consultant, business strategist or agency, you don’t want a beautifully formatted report sitting in your inbox. You want the business to move.

    More enquiries.
    Better visibility.
    More customers.
    Better positioning.
    More revenue.
    Whatever the actual objective may be.

    But there is a problem that both clients and consultants sometimes discover after the engagement has already begun:

    What if the person responsible for the result doesn’t control the things that determine the result?

    Welcome to the Accountability Trap.

    And this is one of the most uncomfortable lessons I’ve learned from working on the web for more than two decades.

    The project that made me think about this

    Recently, I had a conversation with a potential client whose business was built around personal expertise.

    The business already had an established personal brand, an existing website, one-to-one work, advisory/coaching services and a body of professional experience.

    But there was a much bigger commercial question sitting underneath it.

    Could that expertise be expanded beyond individual clients into areas such as:

    • executive coaching and advisory
    • leadership development
    • team programmes
    • corporate training
    • professional communication programmes
    • workshops
    • keynote speaking
    • corporate events
    • organisational programmes
    • customised engagements

    In other words, this wasn’t simply a “build me a website” project.

    It was potentially a business-positioning, website, content, SEO and market-development project.

    The challenge was figuring out how to create a digital presence that could accommodate both sides of the business: someone looking for one-to-one coaching, and an HR leader looking for a workshop for 30 employees, a CEO looking for executive advisory, or an event organiser looking for a speaker. That broader multi-audience approach was actually the central idea behind the strategy I proposed.

    And that distinction matters.

    Because when a business is trying to move from “I sell my expertise to individuals” toward “I can potentially sell my expertise through multiple engagement models”, the website is no longer just a brochure.

    It becomes part of the business-development infrastructure.

    The website needs to explain the expertise, establish credibility, separate different audiences, present different ways of engaging, create appropriate conversion paths and eventually help us learn which opportunities the market actually responds to.

    I was therefore not looking at the project and thinking:

    “Nice website. Let’s change the colours and do some SEO.”

    That would have been wonderfully easy.

    It also would have missed the point.

    The website already had a polished visual presentation. The question I was asking was much more fundamental:

    “Does the current digital presence communicate all the commercial opportunities this person could realistically pursue?”

    And after studying the business, I didn’t think the problem could honestly be reduced to:

    “Let’s do some SEO.”

    That would have been the easy thing to sell.

    It just wasn’t the thing I believed needed to happen first.

    The website wasn’t necessarily bad

    This distinction matters.

    A website can look good and still be strategically wrong for the business it is supposed to support.

    That’s a completely different diagnosis from:

    “Your website sucks. Give me ₹X and I’ll fix it.”

    The existing website had a premium visual presentation and communicated expertise.

    But I believed the larger commercial opportunity wasn’t being communicated clearly enough.

    The business could potentially serve several different audiences and engagement models:

    • individuals
    • executives
    • founders
    • teams
    • organisations
    • workshops
    • programmes
    • speaking engagements
    • events
    • advisory work

    The question wasn’t:

    “Should this become a corporate website instead?”

    The question was:

    “Can the digital presence accommodate the different markets without confusing the visitor?”

    That distinction became the foundation of my proposal.

    The proposal explicitly recommended creating a broader platform rather than forcing the business into either “individual” or “corporate” positioning.

    So I did what I normally do

    I went deep.

    Instead of throwing together a three-page SEO proposal, I looked at:

    • positioning
    • audience architecture
    • services
    • commercial opportunities
    • website structure
    • conversion journeys
    • content
    • SEO
    • LinkedIn
    • authority building
    • speaking opportunities
    • programmes
    • market validation
    • longer-term intellectual property

    The proposal was built around the idea that the website shouldn’t simply be a digital brochure.

    It should become a platform for discovering what the market actually responds to.

    That meant testing different opportunities instead of pretending that we already knew which one would become the biggest revenue channel.

    That philosophy was explicitly built into the proposed 90-day approach: discovery first, positioning and website strategy next, then market activation and validation.

    And I deliberately didn’t promise:

    “You’ll make ₹X.”

    Or:

    “You’ll get 100 leads.”

    Or:

    “You’ll rank #1.”

    Or:

    “You’ll definitely get corporate contracts.”

    The proposal specifically stated that revenue, lead volume, rankings, corporate contracts, speaking opportunities and media coverage could not responsibly be guaranteed.

    Because that’s not how serious consulting works.

    Then we reached the interesting part

    The client had previous experience with expensive marketing work that, from their perspective, hadn’t produced the expected results.

    That matters.

    If you’ve already spent a substantial amount of money on marketing and don’t believe you received meaningful results, you’re naturally going to be cautious about spending again.

    That’s not stupidity.

    That’s not irrationality.

    That’s not even necessarily distrust of consultants.

    It’s a completely understandable reaction:

    “Why should I spend more money when the last person didn’t produce what I expected?”

    And this is exactly where the relationship between client and consultant becomes important.

    Because there are actually two different questions hiding inside that sentence.

    Question 1:

    Is the consultant’s strategy good?

    Question 2:

    Does the consultant have enough control to execute that strategy properly?

    Those are not the same thing.

    Here’s where the handcuffs appear

    Imagine you hire an SEO consultant.

    They identify technical problems.

    But they cannot change the website.

    They identify conversion problems.

    But they cannot change the landing pages.

    They recommend new content.

    But somebody else decides what gets published.

    They recommend changes to navigation.

    But another developer controls the site.

    They identify tracking problems.

    But they can’t access analytics.

    They recommend a new positioning strategy.

    But the existing website remains untouched.

    They recommend experiments.

    But nobody implements them.

    And then, three months later:

    “So… where are my results?”

    That’s the moment the consultant discovers the handcuffs.

    And here’s the uncomfortable truth

    The client may have done nothing wrong.

    They have every right to say:

    “I want to keep my website.”

    They have every right to say:

    “My existing developer will make the changes.”

    They have every right to say:

    “I don’t want a complete redesign.”

    They have every right to control their own business.

    Absolutely.

    The consultant doesn’t own the business.

    The client does.

    But the consultant also has a right to say:

    “If I’m being held responsible for the outcome, I need sufficient control over the things that influence the outcome.”

    That’s not arrogance.

    That’s basic accountability.

    Responsibility must follow control

    This is probably the single most important lesson in the entire story.

    If I’m hired to provide strategy, I’m responsible for the quality of my strategic thinking.

    If I’m hired to build the website, I’m responsible for what I build.

    If I’m hired to implement SEO, I’m responsible for the work I actually control.

    If I’m hired to deliver a specific business outcome, the situation becomes much more complicated.

    Because business outcomes depend on many things:

    Strategy + execution + budget + product + pricing + market demand + sales + positioning + website + content + distribution + competition + timing + client decisions.

    One person rarely controls all of those.

    So promising an outcome while controlling only one tiny piece of the machine is dangerous.

    For everyone.

    The Consultant’s favourite sentence should sometimes be:

    “I can’t responsibly promise that.”

    That’s not a weak consultant.

    That’s often the responsible one.

    If someone says:

    “I guarantee you’ll rank #1.”

    Ask yourself why.

    Google doesn’t work for them.

    Neither does the competition.

    Neither does the market.

    And certainly not the algorithm.

    Likewise, if someone promises:

    “I’ll guarantee you corporate clients.”

    Ask how.

    What happens if:

    • the offer isn’t attractive?
    • the pricing is wrong?
    • the market doesn’t respond?
    • the client doesn’t follow through?
    • the sales process is weak?
    • recommended changes aren’t implemented?
    • the business takes three months to approve everything?

    A consultant can influence these things.

    A consultant cannot control reality.

    But clients have a responsibility too

    This is the part that often gets missed.

    The consultant isn’t the only person who needs to understand accountability.

    A client hiring an external expert should ask:

    “What exactly am I hiring this person to control?”

    If the answer is:

    “Strategy.”

    Then judge them on strategy.

    If the answer is:

    “Website development.”

    Judge them on the website.

    If the answer is:

    “SEO implementation.”

    Judge the actual SEO work.

    If the answer is:

    “Business growth.”

    Then you need to have a much bigger conversation about access, authority, implementation, decision-making and measurement.

    Because saying:

    “You are responsible for growth”

    while simultaneously saying:

    “You cannot change the website, content, positioning, campaigns, tracking or implementation”

    isn’t really a growth engagement.

    It’s a growth recommendation engagement.

    And those are very different products.

    Here’s another trap: the invisible work

    A lot of strategic work doesn’t immediately produce a shiny dashboard.

    Suppose the first month involves:

    • understanding the business
    • interviewing stakeholders
    • researching competitors
    • analysing positioning
    • restructuring offers
    • designing the website architecture
    • defining audiences
    • determining content territories
    • identifying acquisition channels
    • establishing measurement
    • deciding what not to do

    There may be very little to show in a traditional SEO report.

    No exciting:

    “Congratulations! We published 37 posts!”

    😂

    But that doesn’t mean nothing happened.

    Sometimes the most valuable thing a consultant does is prevent a business from spending six months doing the wrong thing.

    The proposal I prepared deliberately framed the first phase around discovery and validation rather than blindly executing a predetermined marketing checklist.

    And sometimes the consultant’s job is to say:

    “Don’t spend money on SEO yet.”

    This sounds insane if your business sells SEO.

    But it’s one of the most important credibility tests.

    If the website architecture, positioning, offer, conversion journey or business model is fundamentally unclear, pouring money into SEO can simply produce more visitors arriving at a confused destination.

    Traffic isn’t the same as business.

    A ranking isn’t the same as a customer.

    A website isn’t the same as a business model.

    And a beautifully designed website isn’t automatically a commercially effective website.

    SEO needs somewhere worthwhile to send people.

    The website should be part of the machine

    A good website doesn’t merely answer:

    “Who are you?”

    It should also help answer:

    “Why should I care?”

    “Is this relevant to me?”

    “Can you solve my problem?”

    “How can I work with you?”

    “Why should I trust you?”

    “What happens next?”

    And different visitors may need different answers.

    An individual might want coaching.

    An HR leader might want a workshop.

    A CEO might want executive advisory.

    An event organiser might want a speaker.

    Those aren’t necessarily four different businesses.

    They can be four different doors into the same business.

    That was one of the central principles behind the proposed website architecture in this particular engagement.

    The biggest mistake: confusing activity with progress

    This happens everywhere in digital marketing.

    “We published 20 articles.”

    Okay.

    Did anyone read them?

    Did the right people read them?

    Did they demonstrate expertise?

    Did they rank?

    Did they generate relevant discovery?

    Did they support a service?

    Did anyone contact the business?

    Did they help establish authority?

    Same thing with backlinks.

    “We built 100 backlinks.”

    Okay.

    From where?

    Why?

    Relevant to what?

    Editorially earned?

    Useful referral traffic?

    Or just 100 websites nobody has ever heard of?

    Same thing with social media.

    “We posted every day.”

    Wonderful.

    Did the right people see it?

    Did anything happen afterwards?

    Activity is not automatically progress.

    This is why I prefer evidence over marketing theatre

    A serious engagement should progressively answer:

    • Who is responding?
    • What are they responding to?
    • Which problems matter?
    • Which offers make sense?
    • Which channels produce meaningful conversations?
    • Which content attracts the right audience?
    • Which positioning creates trust?
    • Which opportunities deserve more investment?

    That’s much more useful than producing a monthly PDF containing 47 green arrows.

    The proposed engagement explicitly defined success in those terms: progressively understanding audiences, problems, offers, engagement formats, authority topics and acquisition channels.

    And here’s the uncomfortable part for consultants

    Sometimes you need to walk away.

    Even when you want the revenue.

    Especially when you want the revenue.

    Because there is a temptation that every freelancer, consultant, agency owner and small business owner eventually faces:

    “Fuck it. Take the project. We’ll figure it out later.”

    I’ve been there.

    Everyone has.

    But if you already know that:

    • you don’t control implementation,
    • the client doesn’t want the required changes,
    • expectations are unclear,
    • measurement is unclear,
    • the decision-making structure is unclear,

    then accepting the project doesn’t solve your cash-flow problem.

    It merely moves the problem three months into the future.

    And by then the problem has an invoice attached to it.

    Consultants: stop selling things you don’t control

    This is where I think our industry needs some uncomfortable honesty.

    Don’t sell:

    “Guaranteed leads.”

    if you don’t control the sales process.

    Don’t sell:

    “Guaranteed rankings.”

    if you don’t control Google.

    Don’t sell:

    “Guaranteed revenue.”

    if you don’t control the business.

    Don’t sell:

    “We’ll transform your company in 90 days.”

    because you have a PowerPoint deck and a LinkedIn subscription.

    😂

    Sell what you can actually deliver.

    Strategy.

    Research.

    Architecture.

    Implementation.

    Content.

    Technical SEO.

    Conversion optimisation.

    Campaign management.

    Analysis.

    Testing.

    Decision support.

    And where outcomes depend on the client or market, say so.

    That doesn’t make the offer weaker.

    It makes the boundaries clearer.

    Clients: stop buying promises you can’t verify

    The other side needs to hear this too.

    When somebody promises extraordinary results, ask:

    “What exactly will you control?”

    Then ask:

    “What do you need me to control?”

    Then:

    “What happens if your recommendations aren’t implemented?”

    Then:

    “How are we going to measure whether this is working?”

    And perhaps the most important question:

    “What are you NOT promising?”

    A consultant who can clearly explain the limits of an engagement may actually be giving you more useful information than someone who promises the moon.

    The ideal arrangement

    The healthiest client-consultant relationship I’ve found is surprisingly simple.

    Client provides:

    • business knowledge
    • access
    • decisions
    • timely approvals
    • necessary resources
    • implementation cooperation
    • honest feedback
    • commercial context

    Consultant provides:

    • expertise
    • strategy
    • judgement
    • research
    • prioritisation
    • recommendations
    • implementation where contracted
    • measurement
    • course correction

    Both provide:

    Accountability.

    Not blame.

    Not finger-pointing.

    Not:

    “The developer didn’t do it.”

    Not:

    “The client didn’t listen.”

    Not:

    “Google changed the algorithm.”

    Not:

    “The market wasn’t ready.”

    Instead:

    “What happened? What did we learn? What do we change?”

    That’s how real projects improve.

    There is one more distinction I wish more businesses understood

    A consultant is not automatically an outsourced employee.

    There is a massive difference.

    An employee may be expected to execute whatever management decides.

    A strategic consultant is usually being hired because the business wants independent judgement.

    That means the consultant should be able to say:

    “I don’t think that’s the right approach.”

    Or:

    “I don’t think you need to spend money on that yet.”

    Or:

    “The website isn’t the problem you think it is.”

    Or:

    “SEO isn’t the first thing I’d do.”

    Or:

    “I don’t think we should continue with this strategy.”

    That’s part of the value.

    The proposal in this particular case explicitly defined the consultant role as strategic direction, positioning, website strategy, SEO strategy, content strategy, authority building, conversion strategy, market validation and ongoing decision support — rather than functioning as an outsourced marketing department.

    That distinction is incredibly important.

    So who was right?

    That’s actually the wrong question.

    The client had legitimate concerns.

    The consultant had legitimate concerns.

    The client wanted to protect their investment and maintain control over their existing digital setup.

    The consultant wanted enough control over the strategic and implementation environment to be able to stand behind the work.

    Neither position needs to be turned into a villain story.

    The real issue was simpler:

    The engagement structure wasn’t sufficiently aligned with the level of accountability being discussed.

    And once you see that, the whole thing becomes much less dramatic.

    Sometimes the right business decision isn’t:

    “How do we convince them?”

    It’s:

    “Is this actually a structure in which either of us can succeed?”

    If the answer is no, walking away isn’t failure.

    Sometimes it’s the most professional thing both sides can do.

    The Handcuff Test

    I’ve started thinking about this as a simple test.

    Before accepting a web design, SEO, consulting or growth project, ask:

    1. What result am I being held responsible for?

    Be specific.

    2. Which variables determine that result?

    List them.

    3. Which of those variables can I actually control?

    Be brutally honest.

    4. Which variables belong to the client?

    Make those explicit.

    5. Which variables belong to third parties?

    Google. Developers. Platforms. Sales teams. Vendors. Market conditions.

    6. What happens when something outside my control prevents implementation?

    Agree on this before the project begins.

    7. How will we distinguish bad strategy from incomplete execution?

    This one is huge.

    8. How often will we review evidence and change direction?

    Because strategy isn’t a stone tablet.

    How to Avoid the Accountability Trap Before the Project Begins

    The easiest time to solve an accountability problem is before the project starts.

    Not three months later.

    Not when the client asks why traffic hasn’t doubled.

    Not when the consultant discovers that half the recommendations haven’t been implemented.

    And definitely not when everyone is sitting on a Zoom call trying to work out whose fault it is.

    The solution isn’t complicated.

    Before signing the engagement, both sides need to understand what is being attempted, who controls what, what is being measured, and what happens when something outside the consultant’s control affects the result.

    Here is the framework I would use.

    Start With the Outcome — Then Work Backwards

    A client might say:

    “I want more leads from Google.”

    Fair enough.

    But that’s an outcome, not a complete project specification.

    The next question should be:

    “What needs to happen for that outcome to improve?”

    The answer could involve:

    • website architecture
    • technical SEO
    • content
    • search demand
    • page experience
    • conversion paths
    • offers
    • pricing
    • analytics
    • implementation
    • content approvals
    • sales follow-up
    • brand positioning
    • competition
    • market demand

    Suddenly, “get me more leads” doesn’t look quite as simple.

    This is why I prefer to work backwards from the desired business outcome and identify the chain of things that can influence it.

    The objective isn’t to create an excuse for poor performance.

    It is to identify the actual machinery behind the result.

    Separate What Is Controlled From What Is Influenced

    This is one of the simplest ways to prevent future arguments.

    Not everything in a digital-growth project is equally controllable.

    Consultant-controlled

    Depending on the engagement, this might include:

    • strategy
    • research
    • technical implementation
    • content production
    • SEO implementation
    • website development
    • analytics setup
    • testing
    • reporting

    If the consultant has control over it, they can reasonably accept accountability for the quality and completion of that work.

    Shared

    Some things require both parties.

    For example:

    • website changes
    • content approvals
    • positioning decisions
    • offer changes
    • landing-page changes
    • campaign decisions
    • implementation priorities

    The consultant may recommend the change.

    The client may need to approve it.

    A developer may need to implement it.

    That is shared accountability.

    Market-dependent

    Then there are outcomes such as:

    • qualified enquiries
    • organic traffic
    • conversion rates
    • new customers
    • corporate contracts
    • revenue
    • speaking opportunities

    These can be influenced by the work, sometimes substantially.

    But they are not controlled by the consultant alone.

    The market gets a vote.

    Google gets a vote.

    Customers get a vote.

    Competitors get a vote.

    And occasionally, reality walks into the meeting room and votes too.

    Introduce Conditional Accountability

    This is where I think the industry can become much more precise.

    Instead of saying:

    “I guarantee more leads.”

    or:

    “I’m not responsible for results.”

    there is a much more useful middle ground:

    “I will be accountable for the outcomes we agree on, provided the agreed dependencies are implemented and the required access, resources and decisions are available.”

    That’s conditional accountability.

    It isn’t an escape clause.

    It’s an honest description of how complex projects actually work.

    For example:

    Objective: Improve organic enquiries.

    Consultant: Develop SEO and website strategy and implement agreed SEO work.

    Client: Approve positioning, offers and content.

    Developer: Implement agreed website architecture changes.

    Dependency: Critical website changes must be implemented before their SEO/conversion impact can reasonably be evaluated.

    Measurement: Organic visibility, relevant traffic, conversion activity and qualified enquiries are reviewed over an agreed period.

    Now everyone knows what they’re actually responsible for.

    Create a Simple Authority Map

    Before starting a serious project, I’d recommend creating a basic authority map.

    It can be as simple as this:

    AreaConsultantClientThird Party
    StrategyOwnsInput—
    Website architectureRecommends / implements if contractedApprovesMay implement
    ContentCreates if contractedExpertise / approval—
    SEOImplements if contractedCooperationSearch engines
    Website developmentIf includedApprovalDeveloper if external
    Pricing & offersAdvisesOwns—
    Sales follow-up—OwnsSales team
    RevenueInfluencesOwnsMarket

    The exact arrangement will vary from project to project.

    That’s the point.

    There should be an arrangement.

    If the consultant is expected to deliver something, everyone should know whether the consultant has the authority to make the changes necessary to deliver it.

    Put Dependencies in Writing

    This sounds boring.

    It isn’t.

    It can save everybody months of arguments.

    Suppose a consultant says:

    “The website architecture needs to change.”

    The client decides:

    “We’ll keep the current architecture.”

    That’s completely legitimate.

    But it should be documented.

    Something as simple as:

    Recommendation: Restructure website architecture.
    Status: Not approved.
    Impact: Certain SEO and conversion objectives may remain constrained until implemented.

    Now imagine six months later someone asks:

    “Why didn’t we achieve the expected result?”

    You don’t need a courtroom drama.

    You can simply look at the project record.

    The recommendation was made.

    The dependency wasn’t implemented.

    That doesn’t automatically mean the consultant was right.

    It simply means the project had an unresolved dependency.

    That is a much healthier way to discuss performance.

    Define What Happens When a Recommendation Is Rejected

    Clients should absolutely be allowed to reject recommendations.

    A consultant isn’t the owner of the business.

    But there should be a difference between:

    “We considered the recommendation and decided not to implement it.”

    and:

    “We never discussed it again and then wondered why the expected outcome didn’t happen.”

    A useful project process can therefore be:

    Recommended → Accepted → Implemented → Measured

    or:

    Recommended → Deferred → Dependency recorded

    or:

    Recommended → Rejected → Alternative approach agreed

    That keeps disagreement from turning into ambiguity.

    And disagreement isn’t necessarily bad.

    Sometimes a client knows something about their customers that the consultant doesn’t.

    Sometimes the consultant sees something the client has become too close to notice.

    The whole point of having two perspectives is to make better decisions.

    Don’t Make Every KPI a Consultant KPI

    This is another area where projects get themselves into trouble.

    Suppose the contract says:

    “Increase revenue by 30%.”

    That sounds wonderfully measurable.

    It also sounds wonderfully terrifying if the consultant doesn’t control:

    • pricing
    • sales
    • product
    • customer service
    • marketing budget
    • website
    • lead handling
    • fulfilment
    • market conditions

    Instead, create layers of measurement.

    Delivery KPIs

    What was actually done?

    Performance KPIs

    What changed?

    Business KPIs

    Did the business outcome improve?

    This creates a much clearer chain:

    Work → Performance → Business outcome

    The further you move along that chain, the more external variables enter the picture.

    That doesn’t make business outcomes unimportant.

    It simply means they need to be interpreted properly.

    Review the Project as a System, Not a Scoreboard

    A monthly review shouldn’t simply ask:

    “Did we hit the number?”

    It should ask:

    What did we do?

    What was actually implemented?

    What changed?

    Did traffic, rankings, enquiries, conversion rates or other relevant signals change?

    What did we learn?

    Did the market respond differently from what we expected?

    What didn’t happen?

    Were recommendations delayed or rejected?

    Were technical dependencies unresolved?

    What should happen next?

    Continue?

    Change?

    Stop?

    Investigate?

    This turns the engagement into a learning system rather than a monthly trial where somebody is waiting to be convicted.

    Build a Stop, Continue or Change Decision Into the Engagement

    One of the most important things a consultant can offer isn’t another 12-month contract.

    It’s the ability to say:

    “The evidence is telling us to change direction.”

    A serious engagement should therefore have regular decision points.

    Continue

    Something is producing useful evidence.

    Double down.

    Change

    Something isn’t producing the expected response.

    Modify the approach.

    Stop

    Something isn’t justified by the evidence.

    Stop spending money on it.

    Investigate

    There isn’t enough evidence yet because an important dependency hasn’t been resolved.

    This is much healthier than blindly continuing because:

    “Well, we’ve already spent three months on it.”

    That’s sunk-cost thinking wearing a business suit.

    And Clients Should Have an Exit Question Too

    Before signing a consulting agreement, ask:

    “What would make us conclude that this engagement isn’t working?”

    That’s a fantastic question.

    If neither side can answer it, you may not have a strategy.

    You may simply have a subscription.

    A good engagement should have enough flexibility to say:

    “This isn’t working.”

    without immediately becoming:

    “The consultant failed.”

    or:

    “The client didn’t cooperate.”

    Sometimes the strategy was wrong.

    Sometimes the execution was incomplete.

    Sometimes the market didn’t respond.

    Sometimes the assumptions were wrong.

    Sometimes the project was never given the conditions required to work.

    The job of the review is to figure out which one happened.

    The Consultant’s Contract Should Protect the Client Too

    This isn’t merely about protecting consultants from unreasonable clients.

    It protects clients from consultants who hide behind vague promises.

    A good agreement should make it painfully clear:

    • what the consultant will deliver
    • what the client must provide
    • what the consultant controls
    • what the consultant doesn’t control
    • what is included in implementation
    • what requires third-party involvement
    • what is measured
    • when it is measured
    • what happens when dependencies aren’t completed
    • how strategy can change
    • what isn’t guaranteed

    Ironically, more clarity protects both sides.

    The consultant knows what they’re signing up for.

    The client knows what they’re buying.

    And neither has to discover the real scope halfway through the project.

    The Golden Rule: Accountability Must Have an Authority Behind It

    Ultimately, all of this comes back to one principle:

    If you want someone to be accountable for an outcome, give them enough authority to influence the things that determine that outcome.

    And if you don’t want to give them that authority?

    That’s completely fine.

    Just structure the engagement accordingly.

    Hire them as a strategist.

    Hire them as an advisor.

    Hire them to audit.

    Hire them to review.

    Hire them to provide recommendations.

    But don’t quietly convert:

    “Tell me what I should do.”

    into:

    “You are responsible for what happens after I decide whether to do it.”

    That’s where the handcuffs come out.

    And by the time everyone notices them, somebody is usually already asking:

    “So… why aren’t we getting results?”

    If you have:

    100% responsibility + 20% control

    you don’t have a challenging project.

    You have a future argument.

    If you have:

    100% responsibility + 80% control

    now we’re talking.

    And if you have:

    shared responsibility + clearly defined control

    you may have the healthiest arrangement of all.

    The irony

    The entire point of hiring an experienced consultant is supposed to be that they have the judgement to tell you what needs to happen.

    But if you’ve already decided that certain things cannot change, before the consultant has even started…

    that’s okay.

    Just don’t simultaneously expect the consultant to be fully accountable for the outcome.

    You can’t have:

    “Tell me exactly what I need to do.”

    followed by:

    “But I have already decided which things I’m willing to change.”

    And then:

    “Why aren’t we getting the results?”

    That’s how the handcuffs click into place.

    What I learned from this experience

    After 25+ years on the web, I’m becoming increasingly comfortable with one simple idea:

    Not every project is mine to take.

    A project doesn’t become good because there’s money attached to it.

    A client doesn’t become a good fit because they like your proposal.

    A consultant doesn’t become valuable because they charge a lot.

    And a marketing strategy doesn’t become correct because somebody put it into a 40-slide presentation.

    The fit matters.

    The structure matters.

    The control matters.

    The expectations matter.

    The willingness to test and adapt matters.

    And above all:

    Accountability has to have somewhere to stand.

    If you want someone to be responsible for the result, give them enough authority to influence the things that produce the result.

    If you want to retain control over those things, that’s perfectly fine.

    Just hire the person accordingly.

    Maybe you need a strategist.

    Maybe you need a developer.

    Maybe you need an SEO implementation team.

    Maybe you need a marketing department.

    Maybe you need all of them.

    But don’t hire a strategist, give them a pair of handcuffs, and then ask why they aren’t running fast enough.

    The final lesson

    For consultants:

    Don’t promise what you cannot control.

    For clients:

    Don’t demand accountability for things you won’t allow your consultant to influence.

    For both:

    Define the responsibility before the invoice.

    Because the worst consulting engagement isn’t necessarily the one where the strategy fails.

    It’s the one where nobody can determine why it failed because nobody ever agreed on who controlled what.

    And by the time everyone figures that out…

    the handcuffs have already clicked.