An unknown Search Console owner is an access concern that needs verification with your team. Removing a user is not always the whole fix: investigate the verification method and any remaining token that could allow ownership to be established again.
Confirm whether the owner is authorized
Compare the account with current and former agencies, developers and business owners. Record whether the access is verified or delegated and which property is affected. A domain property and a URL-prefix property may use different verification arrangements. Avoid removing the last legitimate owner before you have a controlled way to retain business access.
Identify the verification method
Inspect the method associated with the unexplained ownership. Depending on the property, evidence may involve DNS, an HTML file, a meta tag or another supported account-based method. Google provides management of owners, permissions and unused ownership tokens. Follow the method actually shown for the account rather than searching for an arbitrary filename.
Trace how the evidence reached the site
For an unexpected file or tag, check who could write the web root or page head. For DNS verification, review domain and DNS account access. A WordPress cleanup does not by itself secure a registrar, hosting account or linked Google account. Keep the evidence and timestamps separate from any assumption about the original entry point.
Remove unauthorized access and remaining tokens
An authorized owner should remove the unwanted access and handle its verification evidence using the applicable Google workflow. Preserve legitimate verification belonging to the business. Check unused ownership tokens and verify removal where that control is available. Deleting unrelated TXT records, verification files or analytics integrations can break other services without removing the unwanted ownership.
Review search-facing consequences
Check Search Console messages, submitted sitemaps, security issues and manual actions for changes requiring follow-up. Inspect any suspicious indexed URLs on the actual website before removing content or requesting review. Once the underlying compromise and unauthorized ownership are addressed, document the approved owners and periodically revisit the permissions list.
Questions about this problem
Does removing the user guarantee they cannot return?
Not if the verification evidence still allows ownership to be re-established. Review the relevant tokens and the access path that placed them.
Should I delete all Google verification files?
No. Identify which evidence belongs to the unauthorized owner and preserve the business’s legitimate verification methods.
Primary references
General diagnostic guidance, not a diagnosis of an individual site. Use a recoverable copy for changes that may affect production.