Google Search Console helps a business understand how Google discovers, indexes and presents its website in organic search. Setting it up correctly is not just a technical task. It is also an ownership, access and continuity decision.
This Google Search Console setup checklist is designed for Malta businesses appointing an employee, web developer, SEO consultant or agency. It focuses on creating a durable setup that the business controls, while giving specialists the access needed to do their work.
1. Use a business-controlled Google account
The primary verified owner should be an account controlled by the business, not a personal account belonging only to an external supplier. Record who manages the account, where recovery information is held and what happens when staff or providers change.
Do not share one password across several people. Add named users with the permission level they need. This creates a clearer access trail and makes removal easier when a role ends.
2. Choose the correct property type
Search Console offers Domain and URL-prefix website properties. A Domain property covers the domain across protocols and subdomains, while a URL-prefix property only covers URLs beginning with the exact prefix entered.
- Domain property: useful for a complete view of the root domain, including http, https and subdomains. Verification uses a DNS record.
- URL-prefix property: useful when access must be limited to a specific protocol, subdomain or path. Several verification methods may be available.
For many businesses, a Domain property gives the broadest operational view. A URL-prefix property can still be useful for a specific subdomain, language folder or technical requirement. Document exactly what each property includes so nobody mistakes partial data for whole-site data.
3. Use a verification method that will survive supplier changes
Verification proves control of the website. Google periodically checks that the verification token remains valid, so removing a DNS record, HTML file or meta tag can eventually remove access.
DNS verification is often durable because it sits with domain management, but only authorised people should change DNS. If another method is used, record the token location and ensure it is not removed during a redesign, plugin change or theme replacement.
Google recommends adding more than one verification method where appropriate. This can reduce the risk of losing ownership when a template, analytics tag or technical supplier changes.
4. Keep at least two appropriate owners
A verified owner has the highest level of control. Search Console also supports delegated owners, full users and restricted users. The business should understand these roles before granting access.
- Verified owner: proves ownership through a verification token and has full control.
- Delegated owner: receives owner access from another owner.
- Full user: can view all data and take some actions.
- Restricted user: has limited viewing rights.
Where governance permits, maintain more than one appropriate business-controlled owner so access does not depend on a single employee. Give agencies and contractors the least privilege that supports their agreed responsibilities.
5. Review existing users before adding new ones
Open Settings, then Users and permissions. Confirm every owner and user against a current role or supplier. Remove obsolete access only after confirming that the business retains verified ownership and the necessary technical records.
If taking over from another provider, verify business ownership first. Then review old verification tokens, delegated owners and integrations as part of the handover. The website handover checklist covers the wider account and asset transfer.
6. Confirm the preferred website version
Check that the live website consistently uses its preferred HTTPS and hostname version. Test common alternatives, such as http and www, and confirm that they redirect to the intended canonical version.
A Domain property can combine data across variations, but it does not fix inconsistent redirects or canonicals. Those are website configuration issues that should be investigated separately.
7. Find and validate the XML sitemap
Most WordPress SEO plugins generate an XML sitemap or sitemap index. Open it in a browser and check that it loads without authentication or server errors.
- Confirm the sitemap uses the live canonical domain and HTTPS.
- Check that it contains indexable pages intended for search.
- Exclude staging, test, private, duplicate and intentionally noindex URLs.
- Verify that important content types are included.
- Check that removed sitemap URLs do not continue returning errors indefinitely.
Submitting a sitemap tells Google where the file is located. It does not upload pages to Google or guarantee indexing. Search Console can report whether the sitemap was read and whether parsing errors were found.
8. Inspect representative URLs
Use URL Inspection for a small but representative sample:
- homepage;
- one core service page;
- one recent article;
- one contact or conversion page;
- one page template used across the site;
- one URL that should not be indexed.
Review the indexed status, crawl result, indexing eligibility and Google-selected canonical. If needed, test the live URL to distinguish the current page from Google’s last indexed version.
Request indexing selectively after meaningful updates. Google states that a request is not a guarantee and that sitemaps are more suitable for notifying Google about many URLs.
9. Establish an indexing baseline
Review the Page indexing report and record a dated baseline. Do not treat every excluded URL as an error. Some exclusions are intentional, including redirects, duplicate URLs and pages carrying a valid noindex instruction.
Investigate patterns affecting important pages. Examples include server errors, accidental noindex rules, blocked resources, redirect loops, duplicate canonicals or important URLs that remain discovered but not indexed.
10. Record a performance baseline
In the Performance report, record the chosen date range and review clicks, impressions, click-through rate, queries, pages, countries and devices. Malta’s small market can produce volatile or low-volume data, so avoid drawing strong conclusions from a few days.
Use the baseline to identify meaningful landing pages and query themes, not to create a page for every wording. The SEO keyword research guide explains how to cluster related searches and map them to the right page.
11. Connect measurement without confusing the tools
Search Console reports organic Google Search visibility and search-result interactions. Analytics measures activity after a visitor reaches the website, subject to its configuration and consent setup. The numbers will not always match because the tools measure different events and apply different processing rules.
Document which tool answers each business question. For ongoing review, use the SEO reporting checklist for Malta businesses.
12. Check enhancement and security reports
Review available reports for Core Web Vitals, HTTPS, structured data, manual actions and security issues. The available sections can vary by website and by features Google detects.
Treat each report as a diagnostic signal. Confirm affected URLs and business impact before changing templates or plugins across the whole site.
13. Define alerts, review frequency and responsibility
Assign named responsibility for reviewing messages and reports. A practical operating record should state:
- who owns the property;
- who receives critical notifications;
- who reviews indexing and performance;
- how often routine checks occur;
- who can approve technical changes;
- how incidents are escalated;
- where actions and decisions are recorded.
The frequency should reflect how often the site changes and how important organic search is to the business. A frequently updated ecommerce site may need closer monitoring than a small brochure website.
14. Include Search Console in every website or agency handover
Before a developer or SEO provider leaves, confirm business ownership, review permissions, preserve verification and export any agreed reports. Record the property type, verification method, sitemap location and unresolved issues.
Never let an agency relationship end with the business locked out of its own search data. Our SEO agency onboarding checklist can help establish these controls at the beginning of an engagement.
Search Console setup record
- Business-controlled primary owner
- Backup owner and recovery details
- Property type and exact scope
- Verification method and token location
- Approved owners and users
- Preferred canonical website version
- XML sitemap URL and submission status
- Representative URL inspection results
- Indexing baseline and priority issues
- Performance baseline and review date
- Notification and escalation owner
- Next access-review date
Common setup mistakes
- Allowing an external supplier to remain the only verified owner.
- Creating only a partial URL-prefix property and assuming it covers the whole domain.
- Removing a verification token during a redesign.
- Giving owner access when full or restricted access is sufficient.
- Submitting the wrong sitemap or a sitemap from another property.
- Treating every excluded URL as an indexing failure.
- Requesting indexing repeatedly instead of fixing the underlying issue.
- Reporting average position without queries, pages, dates and business context.
- Leaving former employees or agencies with unnecessary access.
Build a reliable SEO measurement foundation
A correct Search Console setup gives a Malta business direct ownership of its organic-search information and a reliable basis for technical checks, keyword research and reporting. The most important outcome is not simply that the property exists. It is that access, verification, scope and responsibilities remain clear when people and suppliers change.
Digital Consulting Pros provides SEO services in Malta, including Search Console review, keyword research, technical prioritisation and reporting. To discuss your website’s search setup, contact DCP.
Official references
