WHAT YOU'LL LEARN IN THIS GUIDE
- The 7-step Agency Performance Audit framework for evaluating any SEO agency before hiring
- Exactly what data to request from an agency and which excuses to reject
- How to verify Google Search Console data, Ahrefs backlink profiles, and ranking history
- Red flags that signal an agency is padding reports with vanity metrics
- How to evaluate AI search performance and GEO/AEO results, not just Google rankings
- The scoring rubric for grading an agency's historical client outcomes
- How to distinguish real SEO progress from the appearance of progress
Auditing an SEO agency's past performance is the only way to separate agencies that deliver measurable results from the ones that produce polished reports and little else. Most businesses hire an SEO agency based on a sales pitch, a few case studies on a website, and a gut feeling. Then they spend six to twelve months waiting for results that never come. The audit-first approach flips that process: you verify what the agency has actually done for real clients before you write a single check.
This guide gives you a repeatable framework for conducting a full audit of any SEO agency's historical performance. That means pulling real data from Google Search Console, Ahrefs, SEMrush, or SimilarWeb; evaluating backlink quality, not just volume; asking the right follow-up questions when numbers look too good; and assessing whether the agency's past work translates into the kind of AI search visibility that matters in 2026.
DIRECT ANSWER: How to Audit an SEO Agency's Past Performance
To audit an SEO agency's past performance, request verified access to Google Search Console data for past clients, review organic traffic trends in tools like Ahrefs or SEMrush, examine the backlink profile for quality and spam, and ask the agency to walk you through a campaign that underperformed and what they changed. Cross-reference case study claims against third-party data; if the numbers do not match, that is a disqualifying red flag.
1. Why Most Businesses Skip the Audit (and Pay for It Later)
Most buyers trust surface-level proof when they should be pulling the numbers themselves.
An agency's website case study says: "We grew organic traffic by 400% in six months." What that rarely tells you: the baseline was near-zero to begin with, the traffic came from branded queries the client was already ranking for, or the campaign coincided with a competitor's site going offline. These are not lies, but they are not the full picture either.
Auditing an SEO agency's past performance requires you to get behind the case study slides and into the actual GSC dashboards, third-party rank trackers, and backlink audit tools. If an agency refuses to provide access to that level of verification, that is your answer.
Why the stakes are higher in 2026:
Two years ago, you were auditing for Google keyword rankings and organic traffic. Now you need to audit for AI search performance as well. Agencies that have not adapted their strategies to optimize for OpenAI's ChatGPT, Google's AI Overviews, Microsoft Copilot, Anthropic's Claude, and Perplexity will not help you compete in 2026, regardless of how well they performed in 2022.
KEY INSIGHT
A 2025 BrightEdge study found that 68% of B2B decision-makers now begin research in an AI search tool rather than Google. Any agency audit that does not measure AI citation performance is measuring half the picture.
2. The 7-Step Agency Performance Audit Framework
This framework takes approximately four to six hours if you have tool access. You can complete a surface-level version in under two hours using only free tools.
Step 1: Request a Verified Client Reference with Data Access
Ask the agency to provide a current or past client who will grant you read-only access to their Google Search Console for thirty minutes on a call. GSC does not lie. It shows you actual clicks, impressions, average position, and click-through rates by page and query, with historical data going back sixteen months.
What you are looking for: organic traffic that grew during the campaign period and held after the campaign ended. What you are looking at if the numbers are bad: a brief spike during a PPC crossover period, seasonal variance being credited as SEO growth, or organic impressions growing while clicks flatlined (which usually means they ranked for low-intent queries nobody clicks on).
Step 2: Pull the Agency's Clients Through Ahrefs or SEMrush
If the agency gives you client domain names in their case studies (or you can find them via LinkedIn testimonials), run those domains through Ahrefs Site Explorer or SEMrush's Organic Research tool. Set the date range to cover the campaign period.
Look at:
- Organic traffic trend: Does the graph show consistent growth during the period the agency was engaged?
- Referring domain count: Did referring domains grow or did only backlink count grow? Link farms inflate backlink count without adding referring domains.
- Traffic value: Ahrefs estimates the equivalent PPC spend the organic traffic represents. This filters out low-value, high-volume junk keywords.
- Top organic pages: Do the pages driving traffic match the campaign goals the agency claims to have delivered?
Step 3: Audit the Backlink Profile for Quality
Low-quality link building is the fastest way an agency can produce impressive-looking metrics that collapse the moment Google updates its algorithm. Pull the referring domains from Ahrefs or SEMrush and look for:
- Domain Rating below 10 on more than 40% of links
- Links from irrelevant niches (a plumber with backlinks from online casino directories)
- Links from link farm networks (same IP block, same design template, no real traffic)
- Sudden link spikes (100+ new links in a single week) without a content or PR reason
- Anchor text over-optimization (exact match anchor text above 15% of the profile)
Any of these patterns in a past client's backlink profile means the agency was building for short-term ranking gains, not durable authority.
Step 4: Check the Content Output Quality
Ask the agency for links to content they produced for past clients. Open three to five pieces and evaluate them against these benchmarks:
- Does each piece have a direct answer block in the first two hundred words?
- Are the H2 headers phrased as actual questions people search for?
- Is the content written for AI extraction, or is it wall-to-wall prose with no scannable structure?
- Does the piece have schema markup (FAQPage, Article, HowTo)?
- Is the content original, or does it read like a slight paraphrase of a Wikipedia article?
In 2026, content that is not structured for AI citation is not performing content. If an agency produced thousands of words per month with none of these structural elements, their content playbook is outdated.
Step 5: Ask for a Campaign That Underperformed
Every agency has had a campaign that did not deliver the expected results. How an agency handles that question tells you more than their best case study.
A trustworthy agency will describe the underperforming campaign specifically, explain what variables caused the shortfall (competitive SERP, a Google core update, a client who did not implement technical recommendations on schedule), and describe what they adjusted. An evasive agency will tell you they have never had a campaign that did not work, or they will generalize so thoroughly that the answer is useless.
Step 6: Request a Sample Monthly Report
Ask for an anonymized sample of a monthly performance report they delivered to a client. A high-quality report includes: organic traffic trend, keyword ranking movement by cluster, goal completions and conversion attribution, backlink acquisition summary, and a three-item priority list for the following month.
A low-quality report shows: total impressions (not clicks), total keywords ranking (not movement), domain authority (a Moz metric that agencies love because it goes up slowly and never goes down), and no direct connection between SEO activity and business outcomes.
Step 7: Verify AI Search Performance
This is the step most businesses skip, and in 2026 it is the one that matters most for competitive categories.
Ask the agency: "For a client in a competitive niche, show me evidence of AI citation performance." What you are looking for is any of the following: a client brand that appears in ChatGPT responses to relevant queries, Perplexity citations appearing for the client's core service pages, or Google AI Overview inclusions for target keywords.
If the agency cannot demonstrate any of this, they are not running an AEO or GEO strategy. They are running a 2019 keyword ranking campaign with a 2026 price tag.
3. What Data to Request (and What Refusals Mean)
Here is the exact data request list you should send to any agency before committing to a contract.
Tier 1 Requests (Non-Negotiable):
- Read-only GSC access for one past client during a live reference call
- Third-party organic traffic data (Ahrefs or SEMrush domain overview, dated screenshots acceptable)
- A sample monthly report (anonymized)
- Three URLs of content produced for past clients
- One example of a campaign that underperformed with a written explanation
Tier 2 Requests (Recommended):
- A backlink audit export from Ahrefs or SEMrush for one past client domain
- Screenshots of keyword ranking progress over six to twelve months from a rank tracker
- Evidence of AI search citation or AI Overview inclusion for any past client
What refusals signal:
If an agency refuses Tier 1 requests, they likely cannot provide them because the results are not there. "Client confidentiality" is a real consideration for some agencies, which is why the GSC access request is framed as a live call rather than a data export. No client confidentiality policy prevents a reference call where you observe data on screen together.
An agency that refuses all third-party verification, provides only PDF case studies they produced themselves, and offers testimonials but no data access is an agency that wants you to buy their story. That story may be true, but you have no way to verify it without data.
4. Evaluating Google Search Console Data: What to Look For
When you get GSC access on a reference call, here is the exact review process.
Performance Tab: 12-Month View
Set the date range to "Last 12 months" or a custom range covering the campaign period. Look at:
- Total clicks trend: Is the line going up, holding steady, or declining?
- Impressions vs. clicks ratio: If impressions grew but clicks did not, the agency ranked for keywords nobody actually searches with commercial intent.
- Average position: A drop from position 12 to position 4 for a high-value keyword is worth more than a jump from position 74 to position 52 for fifty long-tail queries.
Pages Tab
Sort by clicks. Look at the top ten pages. Do those pages align with the client's commercial goals, or are they driving traffic for informational queries that never convert?
Queries Tab
Sort by clicks. Look at the top twenty queries. How many are branded (client company name)? Branded query traffic grows naturally as the business grows, even without any SEO work. Non-branded organic clicks are the SEO agency's actual contribution.
KEY INSIGHT
Filter out branded queries in GSC by adding a "Query does not contain [brand name]" filter. This isolates the traffic that SEO actually earned versus traffic that would have arrived regardless of the agency's work.
5. Auditing Backlink Quality: The Five Signals That Matter
Volume is not quality. A site with 2,000 backlinks from low-authority, topically irrelevant domains is weaker than a site with 200 backlinks from high-authority, topically relevant sources.
When you pull a past client's backlink profile in Ahrefs, evaluate these five signals:
| Signal | Healthy Range | Red Flag |
|---|---|---|
| Referring domain DR | Average DR 30+ across new links | More than 40% of links below DR 10 |
| Topical relevance | Links from same industry or closely related niches | Links from unrelated niches (gambling, pharma, adult) |
| Link velocity | Steady growth, occasional spikes tied to PR | Large unexplained spikes (50+ links in a week) |
| Anchor text diversity | Brand name 40-60%, natural phrases 30-40%, exact match under 10% | Exact match anchor text above 15% |
| Link retention | Links remain live for 12+ months | High link loss rate in subsequent months |
If an agency's backlink work shows multiple red flags in this table, their link building strategy carries a penalty risk. Google's SpamBrain system and manual link quality reviewers have become aggressive about thin, high-velocity link profiles, and a penalty on a past client's site is your preview of what they would do to yours.
6. Evaluating AI Search Performance: The Questions That Reveal Everything
Traditional SEO audits stop at Google. A thorough audit of an SEO agency's past performance in 2026 must include AI search performance evaluation.
The direct test:
Take a core service or product keyword from one of their past clients. Type that keyword as a question into OpenAI's ChatGPT, Google's Gemini, Perplexity, or Microsoft Copilot. Does the client brand appear in the response? Does the client's website appear as a cited source?
If you test five to ten relevant queries and the client is never cited, the agency did not build AI search visibility. That may not have been in scope when the campaign launched, but it tells you whether the agency has caught up with the current standard.
The structural audit:
Pull one of the content pieces the agency produced for the client. Check for:
- A direct answer in the first two hundred words
- FAQPage schema markup (view source or use a schema validation tool like Google's Rich Results Test)
- Heading tags phrased as questions
- IndexNow submission (check Bing Webmaster Tools if you have access, or ask the agency directly)
- AI bot access in robots.txt (verify by appending /robots.txt to the client domain)
These five elements are the minimum structural requirements for AI search citation eligibility. Content missing all five will not earn citations from ChatGPT, Perplexity, or Google's AI Overviews regardless of how well it ranks in traditional Google results.
CRITICAL RULE
Check the client's robots.txt file directly: append /robots.txt to their domain. If you see "Disallow: /" under GPTBot, PerplexityBot, or ClaudeBot, the agency never configured AI crawler access. That client is invisible to AI search by default.
The robots.txt standard for AI search:
Any SEO agency operating in 2026 should have their clients' robots.txt files configured to allow:
User-agent: OAI-SearchBot
Allow: /
User-agent: ChatGPT-User
Allow: /
User-agent: PerplexityBot
Allow: /
User-agent: Google-Extended
Allow: /
User-agent: ClaudeBot
Allow: /
User-agent: anthropic-ai
Allow: /If a past client's robots.txt blocks any of these bots, the agency either did not know to fix it or did not prioritize AI search. Either way, it is a gap you are inheriting if you hire them.
7. The Agency Performance Scorecard
Use this scoring rubric to grade any agency across five dimensions before committing to a contract.
| Dimension | Weight | Score 1-5 | Notes |
|---|---|---|---|
| GSC verification | 25% | — | Can they prove organic traffic growth via verified data? |
| Backlink quality | 20% | — | Clean, relevant, sustained link profile or spam? |
| Content structure | 20% | — | Are past client articles structured for AI extraction? |
| AI search performance | 20% | — | Are past clients cited in ChatGPT, Gemini, or Perplexity? |
| Transparency & reporting | 15% | — | Do reports show business outcomes, not vanity metrics? |
Scoring interpretation:
- 4.0–5.0 weighted average: Strong candidate. Verify AI search capability and move to contract discussion.
- 3.0–3.9: Capable but has gaps. Define specifically which gaps are acceptable based on your campaign goals.
- Below 3.0: Do not proceed. The performance record does not support the investment.
8. Common Audit Mistakes That Let Bad Agencies Through
| Mistake | Why It Hurts | Fix |
|---|---|---|
| Accepting PDF case studies without verification | PDFs are marketing materials. Numbers are easy to fabricate or cherry-pick. | Request live GSC access or third-party tool screenshots with dates visible. |
| Evaluating domain authority instead of organic traffic | Moz's Domain Authority metric never decreases and can be gamed by cheap link volume. | Use Ahrefs Domain Rating combined with actual organic traffic data. |
| Only checking Google rankings, not conversions | High rankings for unintentional queries produce traffic that never converts. | Ask for GSC goal completion data or GA4 conversion attribution, not just rankings. |
| Ignoring AI search capability | An agency with no AEO/GEO strategy will not help you in AI search. | Test past client domains in ChatGPT and Perplexity before signing. |
| Trusting testimonials over data | Testimonials are curated. Every agency's testimonial page looks identical. | Request a reference call with data access, not just a written testimonial. |
| Skipping the underperformance question | You only learn how an agency operates under pressure when things go wrong. | Ask directly: "Walk me through a campaign that did not perform as expected." |
9. The Co-Citation Test: Does the Agency Understand Brand Entity Building?
One of the most advanced signals in modern SEO is co-citation: whether your brand appears alongside authoritative brands and sources in third-party content across the web. LLMs like ChatGPT and Google's Gemini use co-citation patterns to determine brand authority and citation worthiness.
Ask any agency you are auditing: "What do you do to build co-citation and brand entity presence for clients?"
A capable agency will describe activities like: earning editorial mentions on industry publications, building presence in topically relevant Wikipedia articles, generating Quora and Reddit threads where their client is referenced alongside authoritative sources, and managing brand entity consistency across Google's Knowledge Graph, Crunchbase, and LinkedIn.
An agency that has not thought about co-citation at all will say something like "we build high-quality backlinks." That is not the same thing, and in 2026 it is not enough.
10. How to Track and Maintain Your Audit Process
Auditing an SEO agency's past performance is not a one-time gate. Once you hire an agency, the same verification framework applies to evaluating their ongoing work.
Monthly verification process:
- Open Google Search Console on the first business day of each month.
- Set the comparison range to the previous month versus the same period the prior year.
- Filter for non-branded queries only.
- Record clicks, average position, and CTR for your top twenty target keyword clusters.
- Cross-reference with your rank tracker (Ahrefs Rank Tracker, SEMrush Position Tracking, or STAT).
- Pull new backlinks acquired in the prior month and spot-check five to ten for quality.
- Test three to five of your target queries in ChatGPT, Perplexity, and Google's AI Overviews.
The 60-day review gate:
Every new agency engagement should have a formal sixty-day review. By day sixty you should see: technical recommendations implemented, a content plan in execution, at least one piece of content with proper AI-extraction structure published, and a backlink acquisition report with third-party verification. If none of these are in place at day sixty, the engagement is not working. Do not wait until month six.
Quarterly AI search citation audit:
Set aside thirty minutes each quarter to test twenty-five to thirty queries in AI search tools. Track how many responses mention your brand, cite your pages, or include content from your site. This is the emerging equivalent of keyword ranking tracking, and it is the metric that will matter most as AI search share continues to grow.
Article Summary
- Auditing an SEO agency's past performance requires third-party data verification, not just reviewing their own case studies and testimonials.
- The 7-step Agency Performance Audit framework covers GSC access, backlink quality, content structure, AI search performance, and reporting transparency.
- Request read-only Google Search Console access for a past client during a live reference call. GSC data is verifiable and does not lie.
- Filter branded queries out of GSC data before evaluating organic traffic growth; branded traffic grows with the business regardless of SEO work.
- Backlink quality signals that disqualify an agency include DR-under-10 links above 40%, topically irrelevant domains, and exact-match anchor text above 15%.
- AI search performance is a non-negotiable audit dimension in 2026. Test past client domains in ChatGPT, Gemini, and Perplexity before signing any contract.
- A past client's robots.txt that blocks GPTBot, PerplexityBot, or ClaudeBot signals the agency has not configured AI search crawler access; this is a direct disqualifier.
- An agency that cannot explain co-citation strategy or brand entity building does not have an AEO/GEO capability, regardless of their Google ranking results.
- Use the Agency Performance Scorecard to grade agencies across five weighted dimensions: GSC verification, backlink quality, content structure, AI search performance, and transparency.
- A sixty-day review gate should be built into every new agency contract; by day sixty you should have technical work done, content in execution, and verifiable backlink acquisition.
- Never trust domain authority metrics (Moz DA) as a performance indicator; use Ahrefs DR combined with actual organic traffic data.
- The same audit framework that qualifies an agency before hiring applies to monitoring their ongoing performance after you sign.
Frequently Asked Questions
What documents should I ask an SEO agency to provide before hiring?
Before hiring an SEO agency, request the following: read-only Google Search Console access for one past client during a reference call, an anonymized sample monthly performance report, third-party organic traffic data from Ahrefs or SEMrush for at least one client domain, three to five URLs of content they produced for past clients, and a written explanation of one campaign that underperformed and how they responded. Agencies that refuse Tier 1 verification requests are signaling that the data does not support their claims.
How do I verify an SEO agency's results without access to their client accounts?
Run any past client domain the agency mentions in case studies or LinkedIn testimonials through Ahrefs Site Explorer or SEMrush Organic Research. Set the date range to the campaign period and look at organic traffic trends, referring domain growth, and top organic pages. If the third-party tool data does not align with the growth claims in the case study, ask the agency to explain the discrepancy. Real organic traffic growth shows up in every independent tool; fabricated or misleading claims do not.
What red flags should disqualify an SEO agency during the vetting process?
Five disqualifying red flags: (1) refusal to provide verified third-party data access for past clients; (2) a backlink profile showing more than 40% of links from domains with Ahrefs DR below 10; (3) exact-match anchor text above 15% of total backlinks; (4) past client content with no direct answer structure, no FAQPage schema, and no AI bot access in robots.txt; (5) inability to name a campaign that underperformed and describe what was changed. Any single red flag warrants a follow-up question; two or more is a disqualifier.
How do I evaluate an SEO agency's AI search and GEO performance?
Take a core keyword from one of their past clients and type it as a natural language question into ChatGPT, Perplexity, and Google's Gemini. Check whether the client brand appears in the AI response or is cited as a source. Then pull a content piece the agency produced and check for direct answer blocks in the first two hundred words, FAQPage schema markup, and question-formatted H2 headers. Also check the past client's robots.txt at domain.com/robots.txt to confirm AI bots including GPTBot, PerplexityBot, and ClaudeBot are allowed. Missing all of these signals means the agency has no AEO or GEO capability.
How long does a thorough SEO agency audit take?
A complete audit using the 7-step framework takes four to six hours if you have direct access to tools like Ahrefs or SEMrush and a cooperative agency. A surface-level audit using only free tools (Google's Rich Results Test for schema, direct robots.txt inspection, and Moz's free domain overview) takes sixty to ninety minutes. The live GSC reference call typically runs thirty to forty-five minutes. Build in time for the underperformance discussion, which should be at least fifteen minutes on a call rather than a written response.
Looking to find the right agency for your needs? Read our guide on how to choose an SEO agency for small business and review the questions to ask an SEO agency before hiring. Once you have an agency engaged, learn how to measure AI search visibility to hold them accountable. Understand the difference between an AEO agency vs SEO company, and explore our complete guide to Generative Engine Optimization.
