Search Console Setup: Properties, Verification and Permissions
Set up Search Console in 2026: Domain vs URL-prefix properties, verification methods, owner and user permissions, and an access checklist.
Your Search Console setup decides what data you see and who can change it, so getting properties and permissions right is the first job. Most problems marketers hit later, such as missing subdomains, lost access after a redesign or an agency that still owns the property, start here.
- A Domain property covers every protocol and subdomain. A URL-prefix property covers one exact address prefix.
- Domain properties can only be verified with a DNS record. URL-prefix properties can use HTML file, HTML tag, Google Analytics, Google Tag Manager or DNS.
- Roles are owner (verified or delegated), full user, restricted user and associate.
- Keep at least two verified owners and more than one verification method.
- Branded queries, Insights and other 2026 features work best, and sometimes only, on top-level properties.
Checked 4 November 2026 (CET) against Search Console Help and Google Search Central documentation. Search Console reports and rollouts change often, and some features only appear for eligible properties, so confirm in your own property. "Our view" marks MentionX opinion. Ledgerline is a fictional company used for illustration.
01What is a property?
A property is Search Console's word for something you track. Google's add a property help page lists website properties and, since 2026, platform properties for social and video accounts. For websites there are two types:
| Domain property | URL-prefix property | |
|---|---|---|
| Example | example.com | https://www.example.com/blog/ |
| Covers | http and https, www and every subdomain | Only URLs starting with that exact prefix |
| Verification | DNS record only | HTML file, HTML tag, Google Analytics, Google Tag Manager, DNS and more |
| Best for | The main company view | Team or section views, legacy tracking |
02How does verification work?
Verification proves you control the site. Google's verification help page says verification lasts as long as Search Console can confirm your token is still present and valid. It checks periodically. Remove the token in a redesign and ownership can lapse.
| Method | Works for | Effort | Risk |
|---|---|---|---|
| DNS TXT record | Domain and URL-prefix | Medium, needs DNS access | Lost if DNS is migrated without copying records |
| HTML file upload | URL-prefix | Low with server access | Lost if the file is deleted |
| HTML meta tag | URL-prefix | Low with CMS access | Lost if the template changes |
| Google Analytics | URL-prefix | Low if the GA snippet is on the page | Lost if the snippet is removed |
| Google Tag Manager | URL-prefix | Low if GTM is on the page | Lost if the container snippet is removed |
| Hosting platform | Sites on platforms such as Blogger or Google Sites | Lowest | Platform-dependent |
Child properties you add under a verified parent are auto-verified with the same method.
03Which permission should each person get?
Google's permissions help page defines the roles:
| Role | Can do | Give it to |
|---|---|---|
| Verified owner | Everything, including adding and removing users and owners | Two or more people in your company |
| Delegated owner | Same rights, granted by a verified owner without a token | A backup owner in IT or engineering |
| Full user | View all data and take some actions | SEO and content leads, most agencies |
| Restricted user | Simple view rights on most data | Stakeholders who only need to look |
| Associate | Act on behalf of the site in linked products, without viewing Search Console | Linked services such as Analytics |
Some actions need owner rights: submitting sitemaps in the report, starting a bulk data export, and linking to GA4 (you must be a verified owner).
Our view: the most common setup problem we see is not a missing property but an agency that is the only verified owner. Fix that before anything else.
04How do you choose the property setup for a typical company?
| Site structure | Recommended setup | Why |
|---|---|---|
| One site on one domain | One Domain property | Covers http, https, www and subdomains in one view |
Marketing site plus help. or docs. subdomain | Domain property plus URL-prefix property per subdomain | Domain for totals, URL-prefix for team-specific views |
Country folders (/de/, /fr/) | Domain property plus URL-prefix property per folder | Lets each market team see only its section |
| Separate country domains | One Domain property per domain | Each domain is a separate site to Google |
| Social and video channels | Platform properties (lesson 15) | Separate property type for Instagram, TikTok, X and YouTube content |
Remember that some 2026 features need a top-level property. The branded queries filter isn't available for sub-properties such as https://example.com/blog/.
05Troubleshooting verification
| Symptom | Likely cause | Fix |
|---|---|---|
| "Verification failed" for DNS | TXT record not yet propagated, or added to the wrong host | Wait and retry; check the record is on the root domain |
| Verified, then lost ownership weeks later | The token was removed during a redesign or DNS change | Re-add the token; use more than one method |
| HTML tag method fails | Tag placed in the body or added by a plugin after rendering | Put the meta tag in the head of the homepage |
| GA or Tag Manager method fails | The tracking snippet is not on the homepage or the account lacks the right role | Check the snippet and your role in GA or Tag Manager |
| Can't see a property a colleague uses | You were never added, or you use a different Google Account | Ask an owner to add your exact account |
06Access hygiene checklist
- At least two verified owners from your company, using different methods.
- Agencies on full or restricted user, not owner, unless they need to manage settings.
- Remove people when they leave. Former staff or agencies with owner access can change settings, remove users and start exports.
- Review the user list each quarter. It takes two minutes in Settings > Users and permissions.
- Don't use a shared login. Each person should use their own Google Account so actions are traceable.
07Edge cases worth knowing
- Domain property without DNS access. Marketing teams often can't edit DNS. Ask IT for one TXT record and explain it doesn't change email or web traffic. Until then, use a URL-prefix property verified with an HTML tag or file, and switch later.
- Several brands on subdomains. A Domain property for the root covers them all. Add URL-prefix or path properties for each brand as child properties so each team gets its own view without seeing everything.
- Leaving agencies. When an agency ends, check Settings > Users and permissions and remove both their users and any verification tokens they added. Delegated owners stay until removed.
- Migrating domains. Verify both old and new domains before the move. The Change of Address tool (under Settings) is only available to verified owners of both.
- Ownership disappearing. Ownership lasts as long as the verification token stays in place. A site redesign that drops the HTML tag, or a CMS migration that removes the verification file, silently removes ownership. Verify with more than one method so one failure doesn't lock you out.
08A permissions hack for large teams
Create path properties for sections that different teams own, such as /blog/ for content and /help/ for support. Give each team full user access only to its path property. They get focused reports without being able to change site-wide settings, and the owners keep control of sensitive settings like the generative AI control and bulk export.
09Worked example: Ledgerline's access clean-up
Ledgerline is a fictional accounts-payable software company. Details and numbers are illustrative.
Ledgerline's audit found three properties: two URL-prefix (www and non-www) and nothing covering help.ledgerline.example. The former agency was the only verified owner, using an HTML file that a redesign had already removed, so ownership was close to lapsing. The marketing lead's engineer added a DNS TXT record and verified a new Domain property, then added an HTML tag as a second method. The agency was moved to full user, two former employees were removed and the head of marketing became the second verified owner.
Walkthrough
- In Search Console, open the property selector and click Add property.
- Choose Domain, type the bare domain (for example
example.com) and continue. - Copy the TXT record Search Console shows.
- In your DNS provider, add a TXT record on the root domain with that value. If your provider is listed in the wizard, it can guide you.
- Return to Search Console and click Verify. If it fails, wait an hour and retry.
- Once verified, open Settings > Users and permissions and add colleagues with the right role.
- Add a second verification method (for example the HTML tag) so a DNS change can't lock you out.
- Add URL-prefix properties for sections a team owns, such as
https://example.com/blog/.
10Try it yourself
Audit your access in 15 minutes:
- List every property in your selector and mark each as Domain, URL-prefix or platform.
- For each one, open Users and permissions and copy the user list.
- Mark anyone who has left, any agency with owner access and any shared account.
- Draft the changes you'd make, then make them if you're an owner. If you aren't, send the list to an owner.
11Quick quiz
1. Which verification method is the only way to verify a Domain property?
Answer: A DNS record at your domain name provider.
2. Can a restricted user add annotations?
Answer: No. Restricted users can view annotations but not add or delete them.
3. What happens to child properties when you verify a parent with the HTML file method?
Answer: Child properties you add are auto-verified with the same method.
4. Who should normally get owner access?
Answer: Only people in your company who manage settings and users; agencies usually need full user.
12What should you check before the next lesson?
- You have a Domain property and know who the verified owners are.
- At least two people in your company are verified owners.
- Agencies and contractors have the lowest role they need.
- If you're new to crawling and indexing, read How websites get crawled and indexed.
Next: Performance report basics. Or return to the Search Console for Marketers track.
13Common questions
Should I use a Domain or URL-prefix property? Use a Domain property as your main view because it covers all protocols and subdomains. Add URL-prefix properties for sections a team owns.
How long does verification last? As long as Search Console can still find your verification token. Remove the token and you can lose verified ownership.
What is the difference between full and restricted users? Full users see all data and can take some actions. Restricted users have simple view rights on most data.
Questions people ask
3 answersShould I use a Domain or URL-prefix property?
+
Use a Domain property as your main view because it covers all protocols and subdomains. Add URL-prefix properties for sections a team owns.
How long does verification last?
+
As long as Search Console can still find your verification token. Remove the token and you can lose verified ownership.
What is the difference between full and restricted users?
+
Full users see all data and can take some actions. Restricted users have simple view rights on most data.
Sources
- Search Console Help, Add a website or platform property to Search Consolesupport.google.com
- Search Console Help, Verify your site ownershipsupport.google.com
- Search Console Help, Managing owners, users, and permissionssupport.google.com
- Google Search Central, Introducing the branded queries filter in Search Consoledevelopers.google.com
- All accessed 4 Nov 2026.