August 6, 2019

Does your agency help manage Squarespace sites for small business teams? Do any of those businesses use Squarespace’s integration with Google Search Console? If so, your clients have a potential problem.

The Issue

We were working on a site that had a recent change of ownership. When reviewing Google Search Console, we found that the previous site owner — who is no longer associated with the website or business — could not be unverified in Search Console.

Why? Apparently, Squarespace currently verifies a user via Google’s HTML file upload method. Which works fine until you need to unverify someone. Squarespace doesn’t provide access to the HTML file that is uploaded, so you are stuck. Not an ideal situation.

The Test

We had never tried the Squarespace verification process ourselves due to its limitations, so we reached out to Support to learn more, but they couldn’t answer our questions. Then we asked the Circle community to see if anyone else had ever encountered this situation. No luck. So we pulled up one of our own sites and performed a simple test.

  • We invited a new contributor as an administrator to a Squarespace site.

  • The new contributor used the Squarespace Connected Accounts panel to establish a connection to Google Search Console. This demonstrated that Squarespace adds users to GSC as verified owners via the HTML file upload method.

  • Next we fully removed the new contributor’s permissions from the website. Then over on Squarespace Connected Accounts, we “disconnected” Google.

  • At this point, Squarespace should have (1) automatically removed the HTML file, or (2) provided access to the file to let site owners remove it themselves if desired. Why? The only way to unverify an owner in GSC is to permanently remove their verification token.

Why should you care?

It is a potential privacy concern. Verified owners in Search Console have access to sensitive data and the full scope of Google webmaster permissions. What if the person in question is now a competitor? Or a disgruntled former employee?

And it might be a while before the Squarespace team sorts it all out:

 
Squarespace Support reply

Squarespace Support reply

 

What can you do?

Review your GSC properties to identify any clients that might want to know about the issue. If a client wants to update their information:

  1. Visit Squarespace Connected Accounts and “disconnect” from Google.

  2. Next submit the site URL and the HTML file info (displayed in the GSC verification details) to Squarespace Support. Support said they will need to ask the engineering team to manually remove the file. This is a workaround until the process can be fully fleshed out.

  3. After they remove the file, visit Search Console to unverify the owner.

Note, after submitting our info, there was a 5-day turnaround for the manual removal by the engineering team.

 

Of interest, Squarespace documentation currently lists Google Search Console on a page currently titled “Connecting Social Accounts”:

Squarespace Connect Accounts
 

We also suggested to Squarespace that the Google connection (wherever it ends up residing in settings) should display the name of the user account used for verification — much like they do with social logins. This way site owners could quickly tell if they need to “disconnect” GSC for privacy reasons or other business concerns.

Verifying your Squarespace site with Google Search Console

We understand that Squarespace was attempting to streamline the Google Search Console verification process for one-owner websites, but they didn’t think it through for sites that get transferred to new owners or businesses with staff turnover.


Want monthly search news for Squarespace?