Every agency describes its work as legitimate, which makes the term useful only as a prompt for better questions. The real distinction is between practices that search engines publish rules against and practices they do not, and between agencies that will name what they refuse to do and agencies that will not. That second test is the practical one, because it is the only part of the claim a buyer can check before signing.
What the published rules actually prohibit
Link schemes including buying and exchanging links for ranking purposes, scaled content produced primarily to manipulate rankings, cloaking, sneaky redirects, hidden text and misrepresentation are all set out in published spam policies. This is not a matter of opinion or taste; it is documented, and an agency proposing any of them is proposing a risk that lands on your domain rather than theirs.
Ask what they refuse, and what they would do instead
A firm with standards has a list: no paid links, no private blog networks, no scaled generated content, no fake reviews, no guest posts bought at scale. Ask for that list in the first meeting, and ask what they do instead to earn authority. The answer, usually some combination of original research, digital public relations and genuinely useful content, is slower and is the work you are paying for.
The grey area is where judgement matters
Sponsored content properly marked, syndication, paid directory listings that are genuinely used by buyers, and AI-assisted drafting under editorial control all sit in a space where the rule is about intent and disclosure rather than the technique. An agency that can explain where it draws those lines, and why, is demonstrating the judgement you are actually hiring.
The risk is asymmetric and it is yours
If aggressive tactics work, you gain some months of ranking. If they are caught, the manual action or algorithmic suppression applies to your domain, the recovery takes months, and the agency moves on. That asymmetry, rather than any moral argument, is why the compliant route is the commercially sound one for a business that intends to exist in five years.
Questions people ask about whitehat seo services
Is guest posting against the rules?
Guest posting at scale primarily to build links is treated as a link scheme. A genuine contributed article to a publication your audience reads, written because you have something to say, is ordinary publishing. The distinction is intent and scale, and the agency's own description of the programme usually reveals which it is.
What about buying links?
Paying for links that pass ranking credit is explicitly against published guidance, and paid placements should be marked so they do not. Agencies quoting a number of links per month for a fixed price are almost always describing purchased placement whatever the invoice calls it.
Can we use AI to write content?
As an assistance under editorial control with a human accountable for accuracy, yes. Producing large volumes of unreviewed generated pages primarily to rank is exactly what the scaled content policy addresses, and the fact that a machine wrote it is neither the problem nor a defence.
How do we check what a previous agency did?
Review the backlink profile for sudden bursts of low-quality links, look for thin pages published in volume, and check whether any manual action is reported in your own search console property. Ask the incoming agency to audit the last two years before they propose anything new.