Website due-diligence checklist
Buying a business with a website? The due-diligence checklist: access, licenses, tech debt, SEO health, analytics truth-check, security posture, and ownership verification.
16 checks · copy it, print it, argue with it.
Acquiring a business means acquiring its website, and websites hide debts the balance sheet never shows: expired licenses, Google penalties, analytics that lie, and access held by a developer who left. Run this before the deal closes; it pairs with the takeover service and the rescue guide.
Access and ownership
- Domain registrar account verified in the SELLER's name with transfer initiated pre-closeThe 60-day ICANN lock makes post-close transfers slow
- Hosting, email, CDN, repository credentials inventoried and test-logged
- No critical asset in a departed employee's or contractor's personal accountThis is the takeover page's origin story
Licenses and legal
- Theme/plugin/SaaS licenses audited: expiry, renewal cost, whose card
- Images and content licensed (no scraped assets inheriting with the site)
- Privacy policy and terms match the jurisdictions the site trades in
Technical debt
- Platform versions current-ISH: core, PHP/runtime, plugins/modules with update historyYears-behind means a remediation budget, not a checkbox
- Known broken flows tested: forms, checkout, search, account flows
- Hosting reality checked: plan tier vs actual traffic, backup existence and freshness
SEO health
- Manual-action/penalty check in GSC; index coverage sane
- Backlink profile sampled for spam farms (inheriting penalties is real)
- Rankings spot-checked for the traffic the P&L claims
Analytics truth-check
- Analytics present, unfiltered, and reconciling with claimed traffic/revenue
- Conversion sources verified: real orders/leads vs bot and test traffic
Security posture
- Compromise signs scanned: injected content, unknown admin users, spam pages
- TLS valid; secrets rotation feasible (can every password be changed day one)
Findings become negotiation leverage; undocumented ones become your remediation budget. A scoped due-diligence audit delivers this list executed, with a written risk report, the brief starts it. If the audit finds a hostage situation instead of a checklist gap, that is the takeover track.
Quarterly, and only when the numbers move
Get the rate report before you negotiate.
Updated rate bands across the major stacks and regions, plus what changed and why. No other email.
Want this checklist executed for you? Get a scoped quote, two minutes now, a written answer with price and timeline in two days.