SEO Due Diligence for M&A

TL;DR — SEO due diligence checks whether a company’s organic search traffic, revenue, rankings, content, links, and domains are as valuable as they look before an acquisition. Do not rely on a traffic estimate or a screenshot. Get read-only access to the real accounts, match search traffic to analytics and revenue, look for penalties and security problems, and work out what happens if the sites are merged. The output is not “good SEO” or “bad SEO.” It is a verified baseline, a risk list, and an integration plan the deal team can price and act on.

What SEO due diligence is

SEO due diligence is the process of verifying a target company’s organic search performance, assets, liabilities, and post-deal integration risk before an investment or acquisition.

The word verifying matters. A third-party SEO tool may estimate that a site gets 100,000 visits. That is useful for finding a target. It is not proof that the company gets 100,000 visits, that those visits produce customers, or that the traffic will survive a merger. Proof comes from the target’s own systems.

What you are actually buying

An acquisition may include more search assets than the main website:

• domains, subdomains, country sites, apps, help centers, and old brand domains;
• rankings, content, backlinks, redirectA redirect sends browsers and crawlers from a requested URL to a different one. An HTTP redirect specifically is a 3xx status code paired with a Location header; meta refresh and JavaScript redirects achieve a similar navigation without being a 3xx response themselves. Permanent redirects (301/308) are Google's signal the target should be canonical; temporary ones (302/303/307) aren't. history, and brand demand;
• analytics configurations, Search ConsoleA free Google service that reports how a site performs in Google Search and surfaces problems with how Google crawls, indexes, and serves it. It's first-party data straight from Google — but you don't need it to appear in results. history, CMSA content management system (CMS) is software that lets users create, manage, and publish digital content — like blog posts and pages — without writing raw code. WordPress, Drupal, and Joomla are the most common open-source CMS platforms. templates, and structured dataStructured data is a standardized way of labeling page content (using the schema.org vocabulary in JSON-LD, Microdata, or RDFa) so search engines can understand its meaning. It's not a direct ranking factor — its value is rich results and entity understanding.;
• people, processes, vendor contracts, and platform knowledge needed to maintain it.

Missing one of those can change the integration cost. Missing an old domain renewal can be much worse than missing a title tagThe title tag is the HTML title element in a page's head that specifies the document's title. It's the primary source for the SERP title link and a confirmed light ranking factor — but since August 2021 Google doesn't always show it verbatim..

The first five checks

Start with five questions:

1. Does first-party data support the traffic claim? Compare Search ConsoleGoogle's free tool for monitoring crawling, indexing, and search performance. clicks, analytics landing sessions, and the company’s revenue or lead records.
2. How much is branded? People searching for the company already know it. Non-brand visibility usually tells you more about discovery beyond existing demand.
3. Is performance concentrated? A site dependent on one page, country, partner, or product is riskier than the same traffic spread across durable sections.
4. Is there a hidden liability? Check Search Console’s Manual Actions and Security Issues reports, indexation, spam patterns, and content provenance.
5. What happens after close? Keeping brands separate, consolidating domains, and using a hybrid approach have different costs and search risks.

What the final answer should look like

A useful SEO due-diligence memo gives the deal team four things:

• a verified organic baseline with gaps and caveats;
• a risk register with evidence, severity, likelihood, owner, and remediation cost;
• a scenario model showing what changes under mild, moderate, and severe downside;
• a post-deal plan for domains, content, redirects, measurement, and ownership.

SEO should inform the decision, not make legal or financial claims it cannot support. Content ownership, licensing, privacy, security, and valuation conclusions belong with the relevant specialists.

TL;DR — SEO due diligence is an evidence-reconciliation job. Inventory the full digital estate, obtain direct read-only access, and reconcile Search ConsoleA free Google service that reports how a site performs in Google Search and surfaces problems with how Google crawls, indexes, and serves it. It's first-party data straight from Google — but you don't need it to appear in results., analytics, CRM or ecommerce, finance, server, crawl, and third-party data. Separate brand from non-brand and segment trends by page, template, market, product, and device. Explain seasonality, migrations, tracking changes, and algorithm exposure before you forecast. Inspect indexation, manual actions, security issuesA Google Search Console report that flags signs your site was hacked or hosts content that could harm visitors — phishing, malware, or unwanted software. It's a user-safety flag, not a spam-policy penalty, and you clear it by fixing the problem and requesting a security review., spam, links, content provenance, international setup, and platform dependencies. Then model explicit downside assumptions and the cost of keeping sites separate, consolidating them, or running a hybrid. Deliver a decision memo with traceable evidence, not a health score.

Scope the whole digital estate

SEO due diligence starts with an asset inventory, not a crawl. Ask for every domain, subdomain, country-code domain, app listing, help center, marketplace profile, and legacy brand property the company controls. Include expired or parked domains that still receive links, redirectA redirect sends browsers and crawlers from a requested URL to a different one. An HTTP redirect specifically is a 3xx status code paired with a Location header; meta refresh and JavaScript redirects achieve a similar navigation without being a 3xx response themselves. Permanent redirects (301/308) are Google's signal the target should be canonical; temporary ones (302/303/307) aren't., or carry brand demand.

Record the registrant, registrar, DNS provider, renewal owner, certificate coverage, hosting, CDN, CMSA content management system (CMS) is software that lets users create, manage, and publish digital content — like blog posts and pages — without writing raw code. WordPress, Drupal, and Joomla are the most common open-source CMS platforms., analytics property, Search ConsoleGoogle's free tool for monitoring crawling, indexing, and search performance. property, and primary business owner for each asset. The buyer needs to know what transfers, what merely has access, and what depends on an employee or agency account.

Search Console distinguishes verified owners, delegated owners, full users, and restricted users. Full-user access is appropriately scoped for reviewing the diligence reports. Ownership transfer is a separate control task: have the target’s owner disclose the current users and verification methods, plan how the buyer will become a verified owner, and remove or replace prior tokensA token is the smallest unit of text (or image/audio/video) an LLM processes — roughly 4 characters, or about ¾ of an English word. A context window is the maximum number of tokens (input plus output) a model can hold at once, like its short-term memory. only after checking whether other services depend on them. Google documents the permission model.

Use an evidence hierarchy

SEO evidence gets weaker as it moves away from the company’s systems. Use this order:

The right question is not which source is “correct.” The question is whether their definitions explain the differences. Search Console and analytics count different things, use different time zones, and process data differently. Reconcile them; do not force them to match.

Request direct access, not screenshots

Read-only access should cover the full review period and every material property. Screenshots hide filters, permissions, missing date ranges, and excluded properties.

Ask for:

• Search Console full-user access for messages and report review, including Manual Actions, Security Issues, Links, Page IndexingThe Google Search Console report (formerly Index Coverage) showing how many of your URLs are indexed vs. not indexed, and grouping the not-indexed ones by reason., SitemapsA sitemap is a file that lists the pages, images, videos, and other files on your site so search engines can discover them. It helps discovery, but submitting a sitemap doesn't guarantee crawling or indexing., Crawl StatsA Google Search Console report (under Settings) that shows how Google has crawled your site over the last 90 days — total requests, download size, and average response time, broken down by response code, file type, Googlebot type, and purpose. It's only available for root-level properties (a Domain property or a URL-prefix property verified at the site's root)., and Performance;
• owner-provided evidence of Search Console users and verification methods, plus a separate owner-token transfer and cleanup plan for closing;
• GA4 or the analytics platform, its change history, data-retention setting, key-event definitions, channel rules, filters, consent behavior, and warehouse exports;
• CRM, ecommerce, subscription, or finance exports that connect landing activity to outcomes without exposing unnecessary personal data;
• server or CDN logs, crawl exports, rank history, backlink exports, and release notes;
• CMS, repository, tag manager, DNS, registrar, CDN, and vendor inventories;
• prior migrations, penalties, security incidents, legal removals, content disputes, and significant search or tracking changes.

Use a secure data room and follow the transaction’s confidentiality and least-access rules. Request the minimum personal data needed for validation.

Verify traffic and revenue separately

Traffic verification starts with a fixed cohort and fixed definitions. Pick a period long enough to show seasonality, use the same domains and page groups in every source, and document timezone, attribution, channel, currency, and conversion definitions.

Reconcile four layers:

1. Search demand: impressions and query mix in Search Console.
2. Search acquisition: Search Console clicks and organic landing sessions.
3. Business outcomes: leads, orders, subscriptions, and qualified opportunities.
4. Financial outcomes: recognized revenue, gross profit, refunds, churn, or another finance-approved measure.

A mismatch is not automatically fraud or broken tracking. It is a question. For example, consent loss can reduce analytics sessions while Search Console clicks remain steady. A channel-rule change can move sessions between Organic and Direct. Revenue may be recognized weeks after the first visit.

Check Search Console’s blind spots

Search Console is first-party data, but it is not a complete query ledger. Google says some queries are anonymized and its tables store only the most important rows. Chart totals can therefore exceed query-row totals, and filtering by a query can change the totals because anonymized queries are omitted.

Use property-level totals for the baseline, then segment with page, country, device, search appearance, and query filters. Use bulk export data when it already exists, but do not mistake an empty query stringThe `?key=value` data tacked onto the end of a URL after a question mark — used for tracking, sessions, filtering, sorting, and search — and one of the biggest sources of duplicate URLs and wasted crawling in SEO. for zero demand. Google explains these limits.

Search Console’s branded/non-branded filter is useful where available, but Google says the classification is informational and can be wrong. Export the query rows and review the brand dictionary, product names, founders, abbreviations, and common misspellings. The site’s Brand/Non-Brand Splitter can make that review repeatable without uploading the query file.

Measure dependency, not just totals

Organic trafficVisitors from unpaid search results — it compounds without ad spend. is more fragile when most of its value sits in a small number of assets. Build concentration tables for:

• branded vs. non-branded queries;
• top 10 and top 100 landing pages;
• directories, templates, authors, and content types;
• products, services, and revenue lines;
• countries, languages, devices, and search features;
• individual links, affiliates, publishers, or data suppliers.

Report both the share and the business consequence. “Forty percent of clicks come from five pages” is incomplete. Add whether those pages generate revenue, require licensed data, depend on a single author, or overlap the buyer’s existing pages.

Explain the trend before forecasting it

Trend analysis should distinguish durable performance from a temporary shape in the chart. Use the longest comparable history available and annotate:

• seasonality, promotions, launches, and contract cycles;
• migrations, redesigns, domain changes, and content removals;
• analytics, consent, channel, conversion, or attribution changes;
• major editorial or link campaigns;
• confirmed ranking updates from the Google Search Status Dashboard;
• manual actions, security incidents, outages, and platform changes.

An overlap with a ranking update is not proof the update caused the change. It is a confounder. Segment the affected pages and queries, inspect the implementation, and state how certain the explanation is.

Use the SEO Forecast to test seasonality, level shifts, and prediction intervals against the supplied time series. A forecast is a scenario based on history and assumptions, not a promise that rankings will continue.

Audit technical and indexation health by pattern

Technical review should identify system-level liabilities and integration blockers. Inspect representative templates and reconcile expected inventory with indexation.

Cover:

• crawl access, status codes, index directives, sitemapsA sitemap is a file that lists the pages, images, videos, and other files on your site so search engines can discover them. It helps discovery, but submitting a sitemap doesn't guarantee crawling or indexing., and canonical selection;
• duplicate and parameter spaces, faceted navigationFaceted navigation (faceted search, product filtering) lets visitors refine a list of products or content by attribute — price, color, size, brand, rating. The SEO problem: each filter combination can spawn a distinct crawlable URL, turning a small catalog into millions of near-duplicate pages that waste crawl budget and dilute ranking signals., internal search, and crawl waste;
• renderingTurning HTML, CSS, and JavaScript into the final visual page and DOM. parity between raw HTML and the browser-rendered page;
• structured dataStructured data is a standardized way of labeling page content (using the schema.org vocabulary in JSON-LD, Microdata, or RDFa) so search engines can understand its meaning. It's not a direct ranking factor — its value is rich results and entity understanding., metadata, internal linksAn internal link is a hyperlink from one page on a website to another page on the same website. Internal links help search engines discover your pages and pass ranking signals (PageRank and anchor-text context) between them., orphan pagesAn orphan page is a page on your site that no other page links to internally. Because crawlers discover pages by following links, an orphan page is effectively invisible to search engines unless it's in an XML sitemap or linked from an external site., and paginationPagination splits a large set of content — product listings, blog archives, search results — across multiple sequentially numbered URLs. For SEO, each paginated page should be crawlable, indexable, and self-canonical; Google no longer uses rel=prev/next, but Bing still does.;
• international URL architecture, hreflang, translations, and local-market ownership;
• page experience, mobile behavior, accessibility dependencies, and third-party scripts;
• CMS, code, release controls, monitoring, and the team that can actually ship fixes.

Run a bounded crawl with Scout Site Audit Free to find repeatable patterns, then validate high-risk findings in Search Console, logs, rendered pages, and the underlying platform. A crawl score is not a deal score.

Check manual actions, security, and spam risk directly

The Manual Actions and Security Issues reportsA Google Search Console report that flags signs your site was hacked or hosts content that could harm visitors — phishing, malware, or unwanted software. It's a user-safety flag, not a spam-policy penalty, and you clear it by fixing the problem and requesting a security review. require direct Search Console access. An exported chart cannot replace them. A manual action can affect some or all of a site’s appearance in Search. Security issues can trigger warnings in results or in the browser.

Check the report history, Search Console messages, Safe Browsing evidence, hacked URLs, malware, social engineering, old admin accounts, and unresolved vulnerabilities. Run the Website Safety & Security Checker as an outside-in snapshot, but keep the security team’s review separate and authoritative.

A clean Manual Actions report does not prove that a site has no algorithmic or spam risk. Manual actions are issued by human reviewers. Google also detects policy problems with automated systems. Review practices against Google’s current spam policies, especially scaled content abuseScaled content abuse is Google's spam policy (introduced March 2024) for generating many low-value pages primarily to manipulate search rankings rather than help users — and it applies no matter how the content is created: AI, automation, or human writers., expired domain abuse, site reputation abuse, cloaking, scraping, hacked content, and link spam.

Treat link risk as evidence, not a toxicity score

Backlinks matter when they create value, concentration, or policy exposure. Review the most-linked pages, referring-domain concentration, anchor patterns, historical spikes, sitewide placements, expired-domain history, sponsored links, redirects, and links to pages the integration plan would remove.

Prioritize the review when there is an active manual action, an unexplained link spike, a business model built on paid placements, or a few domains carrying most of the authority. Do not mass-disavow links because a vendor labels them “toxic.” Google warns that incorrect use of the tool can harm a site’s performance and says most sites do not need it. Review Google’s Disavow links guidance before recommending any action.

The link review should end with protected URLs, questionable patterns, remediation work, and integration consequences. It should not end with one proprietary score.

Review content provenance and AI risk

Content review needs a provenance sample, not only a quality score. For material page groups, record who created the content, which sources or datasets it uses, what rights or licenses support it, how it is reviewed, and whether those inputs transfer after close.

Flag scraped or lightly transformed content, copied product descriptions, licensed feeds, user-generated content, freelance agreements, third-party images, programmatic templates, translation vendors, and automated publishing. Google says generative AI can help with research and structure, but generating many pages without adding value may violate its scaled-content policy. Its current guidance emphasizes accuracy, quality, relevance, and context.

SEO can identify operational and search risk. Counsel should determine ownership, copyright, trademark, privacy, licensing, and transfer rights. The U.S. Copyright Office’s 2025 copyrightability report says protection for generative-AI output depends on sufficient human-authored expression; applying that rule to a content library is a legal review, not an SEO conclusion.

Find international and platform dependencies

International value can disappear when the buyer acquires traffic but not the systems or people that serve it. Inventory country domains, local entities, translation memory, regional CMS instances, currencies, product availability, local links, and market-level analytics.

Google recommends separate URLs for language versions and supports hreflang or sitemaps for labeling variants. A platform that switches content only by cookies, browser language, or IP can hide variants from crawlersA crawler — also called a spider or bot — is an automated program that fetches web pages, extracts their links, and queues new URLs to visit. Search engines use crawlers to discover and download content for their index.. Google’s international-site guidance is the baseline, but the commercial and regulatory setup still needs local specialists.

Platform dependencies include the CMS, search and recommendation systems, CDN, edge rules, analytics, schema generation, data feeds, image hosting, consent tools, and agencies. Record contract ownership, exportability, termination dates, custom code, credentials, and the people who understand each system.

Model the integration before valuing the upside

Post-deal search value depends on what happens to the web properties. Model three architectures:

Do not add both sites’ traffic together and call it the merged forecast. Overlapping queries, duplicate pages, brand changes, removed products, and different conversion rates make that arithmetic unreliable.

For a consolidation, inventory old and new URLs, choose the canonical content for each topic, protect the most-linked and highest-value pages, preserve legacy brand demand, and estimate the redirect, content, engineering, and monitoring work. Google recommends mapping old URLs to new destinations and changing one major thing at a time in its site-move guidance.

Use explicit valuation scenarios

SEO does not have a universal valuation multiple. Use the buyer’s finance-approved model and show how the organic contribution changes under transparent assumptions.

An illustrative sensitivity table might use:

Those percentages are example assumptions, not benchmarks, probabilities, or financial advice. Replace them with deal-specific bands approved by finance and the investment team.

Keep the math explicit:

Steady-state annual organic contribution
= verified annual organic contribution × retention assumption
− incremental recurring annual operating cost

Year 1 net organic cash contribution
= steady-state annual organic contribution
− one-time remediation and integration cash cost

Use that layout only when every term follows the same finance-approved cash and contribution definitions. Otherwise, give finance the retention and cost inputs without netting them. Finance can place one-time and recurring cash flows in the correct periods and apply its approved profit definition, tax treatment, discount rate, NPV method, and valuation approach. Avoid double-counting the same risk as both a traffic haircut and a full remediation deduction without explaining why.

Red flags that should change the decision

The most important red flags are evidence and control failures:

• the seller will not grant direct, appropriately restricted access to material systems;
• traffic, conversion, and finance data cannot be reconciled within documented limits;
• most value depends on one page, query, market, partner, author, or licensed feed;
• a recent tracking reset, migration, or ranking spike makes the baseline unstable;
• Manual Actions, security issues, hacked content, or unresolved vulnerabilities exist;
• content, domains, data, images, or software may not transfer with clear rights;
• traffic depends heavily on scaled low-value pages, paid links, or spam patterns;
• material country sites, domains, redirects, or verification tokens are not controlled;
• the required platform, vendor, agency, or staff knowledge will not transfer;
• the integration plan removes the content or brand demand producing the value.

A red flag is not automatically a no-go. It should change the evidence grade, downside case, remediation plan, cost, ownership, or transaction discussion.

Make a go, conditional, or no-go recommendation

The SEO recommendation should use three states:

Go: the baseline is supported by first-party evidence, material assets and access can transfer, performance is reasonably distributed, and integration work fits the approved case.

Conditional: value is credible, but specific access, rights, security, remediation, or integration conditions must be resolved and priced. Counsel and the deal team decide whether and how those conditions affect transaction documents.

No-go or re-underwrite: material performance cannot be verified, essential assets or rights do not transfer, the downside case fails the investment threshold, or an unresolved policy, security, or integration issue could eliminate the modeled value.

The recommendation should name which evidence would change it. “Conditional pending Search Console access and revenue reconciliation” is useful. “SEO looks risky” is not.

Deliver one traceable decision memo

The final memo should be short enough to use and detailed enough to audit. Include:

1. scope, properties, access received, and missing evidence;
2. verified traffic and business baseline with definitions;
3. brand/non-brand, concentration, trend, and dependency analysis;
4. technical, policy, security, link, content, and platform risks;
5. keep-separate, consolidate, and hybrid integration scenarios;
6. valuation sensitivities with assumptions and excluded claims;
7. recommendation, conditions, owners, cost range, and next validation step.

Attach source exports and working files separately. Every headline claim in the memo should trace to a report, export, test, interview, contract review, or clearly labeled assumption.

Final thoughts

The best SEO due diligence does not produce the biggest audit. It finds the few facts that can change the price, the integration plan, or the decision.

Treat estimates as discovery, first-party systems as evidence, and forecasts as assumptions. If the traffic cannot be reconciled or the assets cannot transfer, do not solve that uncertainty with a prettier spreadsheet.

The sensitivity bands in this guide are illustrative assumptions, not valuation benchmarks. Finance, legal, security, accounting, and tax specialists should own their respective conclusions.

AI summary

A condensed take on the Advanced version:

• SEO due diligence verifies value. Inventory every domain, property, platform, account, vendor, and legacy asset, not only the main website.
• First-party evidence comes first. Reconcile Search ConsoleA free Google service that reports how a site performs in Google Search and surfaces problems with how Google crawls, indexes, and serves it. It's first-party data straight from Google — but you don't need it to appear in results., analytics, CRM or ecommerce, finance, logs, and crawls. Use third-party estimates for context, not proof.
• Separate traffic from revenue. Search clicks, landing sessions, conversions, and recognized revenue answer different questions and will not match perfectly.
• Measure dependency. Split brand/non-brand and test concentration by page, template, market, product, partner, author, data feed, and platform.
• Explain trends before forecasting. Annotate seasonality, releases, migrations, tracking changes, security incidents, and confirmed ranking updates.
• Inspect hidden liabilities. Review indexation, technical patterns, Manual Actions, Security IssuesA Google Search Console report that flags signs your site was hacked or hosts content that could harm visitors — phishing, malware, or unwanted software. It's a user-safety flag, not a spam-policy penalty, and you clear it by fixing the problem and requesting a security review., spam practices, links, content provenance, AI workflows, and rights.
• Model integration. Keeping properties separate, consolidating them, or using a hybrid changes traffic retention, cost, governance, and migration risk.
• Use explicit scenarios. Apply deal-specific retention assumptions to verified organic contribution, subtract remediation and operating costs, and let finance apply the approved valuation method.
• Recommend go, conditional, or no-go. Name the evidence and conditions that would change the recommendation.
• Stay in the SEO lane. Flag legal, security, accounting, tax, and finance issues; do not turn an SEO review into unsupported professional advice.

Official documentation

Primary sources for claims and checks used in an SEO due-diligence review.

Google Search and Search ConsoleA free Google service that reports how a site performs in Google Search and surfaces problems with how Google crawls, indexes, and serves it. It's first-party data straight from Google — but you don't need it to appear in results.

• About Search Console data: coverage, privacy omissions, table limits, processing, and differences from analytics.
• Performance report dimensions and data groupings: anonymized queries, row truncation, canonical aggregation, and branded filtering.
• Managing owners, users, and permissions: access levels and the verification tokensA token is the smallest unit of text (or image/audio/video) an LLM processes — roughly 4 characters, or about ¾ of an English word. A context window is the maximum number of tokens (input plus output) a model can hold at once, like its short-term memory. that can survive a transfer.
• Manual Actions report: current actions, history, affected scope, and review process.
• Security Issues report: hacked content, malware, unwanted software, social engineering, and reviews.
• Spam policies for Google Web Search: scaled content, expired domains, site reputation, scraping, links, and other abuse.
• Disavow links to your site: Google’s warning that incorrect use can harm search performance and that most sites do not need the tool.
• Google Search Status Dashboard: confirmed ranking updates and Search incidents to annotate in trend analysis.
• Site moves with URL changes: change sequencing, URL mapping, redirectsA redirect sends browsers and crawlers from a requested URL to a different one. An HTTP redirect specifically is a 3xx status code paired with a Location header; meta refresh and JavaScript redirects achieve a similar navigation without being a 3xx response themselves. Permanent redirects (301/308) are Google's signal the target should be canonical; temporary ones (302/303/307) aren't., launch, and monitoring.
• Managing multilingual and multi-regional sites: international URL and targeting considerations.
• Guidance on generative AI content: accuracy, quality, relevance, disclosure context, and scaled-content risk.

Analytics and rights context

• Google Analytics change history: the two-year record of account and property changes available to Editors.
• Google Analytics data freshness: processing windows and why recent data can change.
• U.S. Copyright Office, Copyright and Artificial Intelligence Part 2: U.S. copyrightability analysis for generative-AI outputs. Use counsel for application to a specific target, jurisdiction, contract, or content library.

Quotes from the source

Verified statements that explain why direct access and careful interpretation matter.

Google Search ConsoleA free Google service that reports how a site performs in Google Search and surfaces problems with how Google crawls, indexes, and serves it. It's first-party data straight from Google — but you don't need it to appear in results. on manual actions

• “If a site has a manual action, some or all of that site will not be shown in Google search results.” Google Search ConsoleA free Google service that reports how a site performs in Google Search and surfaces problems with how Google crawls, indexes, and serves it. It's first-party data straight from Google — but you don't need it to appear in results. Help. Jump to quote

Google Search ConsoleGoogle's free tool for monitoring crawling, indexing, and search performance. on acquired-site security issuesA Google Search Console report that flags signs your site was hacked or hosts content that could harm visitors — phishing, malware, or unwanted software. It's a user-safety flag, not a spam-policy penalty, and you clear it by fixing the problem and requesting a security review.

• “If you recently bought a site that had pre-existing security issues, fix the issues listed in the Security Issues reportA Google Search Console report that flags signs your site was hacked or hosts content that could harm visitors — phishing, malware, or unwanted software. It's a user-safety flag, not a spam-policy penalty, and you clear it by fixing the problem and requesting a security review., then let us know in your reconsideration request that you recently acquired the site and that it now adheres to the spam policies for Google web search.” Google Search Console Help. Jump to quote

Google Search Console on missing query rows

• “Some queries are omitted from the report to protect user privacy.” Google Search Console Help. Jump to quote

Google Search Central on migration sequencing

• “Change only one thing at a time”. Google Search Central. Jump to quote

Google Search Central on generated content

• “using generative AI tools or other similar tools to generate many pages without adding value for users may violate” Google’s scaled-content policy. Google Search Central. Jump to quote

SEO due-diligence request checklist

Scope and ownership

• All domains, subdomains, ccTLDsCountry-code top-level domain like .de or .co.uk — a strong geotargeting signal., apps, help centers, storefronts, and legacy brands listed.
• Registrar, DNS, CDN, hosting, certificate, CMSA content management system (CMS) is software that lets users create, manage, and publish digital content — like blog posts and pages — without writing raw code. WordPress, Drupal, and Joomla are the most common open-source CMS platforms., and renewal owners recorded.
• Material vendors, agencies, licenses, contracts, and named technical owners listed.
• Search ConsoleA free Google service that reports how a site performs in Google Search and surfaces problems with how Google crawls, indexes, and serves it. It's first-party data straight from Google — but you don't need it to appear in results. properties and verification methods mapped to the full estate.

Performance and revenue

• Search ConsoleGoogle's free tool for monitoring crawling, indexing, and search performance. access plus full-period exports by date, page, query, country, device, and search type.
• Analytics access, retention setting, change history, channel definitions, key events, and warehouse exports.
• CRM, ecommerce, subscription, or finance outcomes available under appropriate privacy controls.
• Rank, backlink, crawl, server/CDN log, release, and incident history supplied.
• Brand dictionary includes products, founders, abbreviations, prior names, and misspellings.

Risk and transferability

• Manual Actions, Security IssuesA Google Search Console report that flags signs your site was hacked or hosts content that could harm visitors — phishing, malware, or unwanted software. It's a user-safety flag, not a spam-policy penalty, and you clear it by fixing the problem and requesting a security review., messages, legal removals, and past incidents reviewed.
• Content authorship, sources, licenses, feeds, images, translations, and AI workflows sampled.
• Link concentration and questionable acquisition patterns inspected where material.
• Platform, custom code, data-feed, consent, analytics, and staff dependencies documented.
• International entities, domains, translations, hreflang, and market ownership reviewed.

Integration and decision

• Keep-separate, consolidate, and hybrid paths compared.
• URL overlap, protected pages, legacy brand demand, redirectsA redirect sends browsers and crawlers from a requested URL to a different one. An HTTP redirect specifically is a 3xx status code paired with a Location header; meta refresh and JavaScript redirects achieve a similar navigation without being a 3xx response themselves. Permanent redirects (301/308) are Google's signal the target should be canonical; temporary ones (302/303/307) aren't., and migration effort estimated.
• Base and downside scenarios use labeled assumptions and avoid double-counting risk.
• Every headline finding has evidence, confidence, owner, remediation, and next test.
• Recommendation states go, conditional, or no-go and names what would change it.

Risk-register template

Use one row per decision-relevant finding. Do not hide several problems inside one generic “technical SEOTechnical SEO is the practice of making a site easy for search engines to crawl, render, index, and (now) be eligible for AI answers. It's the foundation that lets your content and links rank — not a ranking trick of its own.” row.

Decision-memo template

SEO DUE-DILIGENCE DECISION MEMO

Recommendation: Go / Conditional / No-go or re-underwrite
Scope: [PROPERTIES, MARKETS, PERIOD]
Access received: [SYSTEMS]
Material evidence gaps: [GAPS]

Verified baseline
- Search clicks and landing sessions:
- Organic-sourced outcomes and finance measure:
- Brand/non-brand split:
- Concentration and dependency:

Decision-relevant risks
1. [FINDING] | evidence | confidence | exposure | remediation
2. [FINDING] | evidence | confidence | exposure | remediation

Integration paths
- Keep separate:
- Consolidate:
- Hybrid:

Sensitivity assumptions
- Base:
- Mild downside:
- Moderate downside:
- Severe downside:

Conditions and owners
- [CONDITION] | owner | proof | decision date

Claims excluded from the model
- [UNVERIFIED OR NON-TRANSFERABLE CLAIM]

Four mental models for SEO due diligence

Evidence beats estimates

Third-party estimates find targets and questions. First-party systems verify the baseline. Finance records verify financial outcomes. Each source has a job; none does all of them.

Value equals performance times transferability

Traffic that depends on a non-transferable license, employee, domain, feed, or platform is not equivalent to traffic the buyer can operate after close. Verify both performance and control.

Concentration converts totals into risk

The same annual traffic can carry very different risk depending on whether it is spread across a portfolio or held by five pages and one branded query. Segment before you rate.

Integration is part of the valuation case

Keeping sites separate has operating cost. Consolidating them has migration and overlap risk. A hybrid has governance complexity. Model the intended architecture before you claim synergy.

Severity matrix

High severity without evidence is speculation. High exposure without evidence is an underwriting gap. Keep those labels separate.

Can the organic contribution enter the deal model?

Per-deal SEO due-diligence SOP

Use the same gates on every target so enthusiasm does not change the evidence standard.

1. Freeze scope and definitions. List the properties, period, currencies, channels, outcome definitions, and known exclusions. Done means every source will be compared against the same estate and time basis.
2. Open the evidence room. Confirm direct read-only access and preserve dated exports. Done means every material claim has a source or is labeled unverified.
3. Reconcile performance. Compare clicks, sessions, outcomes, and finance measures; document every material difference. Done means discrepancies are explained or promoted to the risk register.
4. Segment dependency. Split brand/non-brand and group by page, template, product, market, and platform. Done means concentration is measured at the level that could fail or transfer.
5. Explain history. Annotate seasonality, updates, releases, tracking changes, migrations, and incidents. Done means the forecast does not silently treat a break or temporary spike as normal growth.
6. Inspect liabilities. Review technical patterns, manual actions, security, spam, links, content provenance, rights flags, international setup, and vendors. Done means decision-relevant risks have evidence, owner, cost, and next proof.
7. Model integration. Compare separate, consolidated, and hybrid architectures. Done means protected URLs, brand demand, redirectsA redirect sends browsers and crawlers from a requested URL to a different one. An HTTP redirect specifically is a 3xx status code paired with a Location header; meta refresh and JavaScript redirects achieve a similar navigation without being a 3xx response themselves. Permanent redirects (301/308) are Google's signal the target should be canonical; temporary ones (302/303/307) aren't., content overlap, staffing, and monitoring are included in the plan.
8. Stress-test and decide. Apply approved retention assumptions and costs, then issue a go, conditional, or no-go recommendation. Done means the memo states what evidence would change the decision.

SEO due-diligence mistakes

Treating an estimated traffic curve as audited performance

Why it fails: estimates do not prove visits, conversions, revenue, property scope, or transferability.

Do instead: reconcile first-party Search ConsoleA free Google service that reports how a site performs in Google Search and surfaces problems with how Google crawls, indexes, and serves it. It's first-party data straight from Google — but you don't need it to appear in results., analytics, business outcomes, and finance data. Keep the estimate as market context.

Calling all organic traffic non-brand opportunity

Why it fails: brand searches often reflect demand created elsewhere and may change after a rebrand or integration.

Do instead: review brand and non-brand separately, including legacy names, products, founders, abbreviations, and misspellings.

Using a clean Manual Actions report as a clean bill of health

Why it fails: the report covers human-issued actions, not every algorithmic, content, link, or quality risk.

Do instead: review policy-sensitive practices and performance patterns alongside the report.

Rating every strange backlink as toxic

Why it fails: proprietary toxicity scores can create noise and encourage harmful mass disavows.

Do instead: focus on manual actions, paid or controlled schemes, concentration, historical spikes, protected URLs, and integration consequences.

Forecasting a merged site by adding both traffic totals

Why it fails: overlapping queries, duplicate contentThe same or very similar primary content reachable at more than one URL. There's no general duplicate content penalty — the real costs are possible signal dilution, the wrong URL getting chosen, and less-efficient crawling., brand changes, redirectsA redirect sends browsers and crawlers from a requested URL to a different one. An HTTP redirect specifically is a 3xx status code paired with a Location header; meta refresh and JavaScript redirects achieve a similar navigation without being a 3xx response themselves. Permanent redirects (301/308) are Google's signal the target should be canonical; temporary ones (302/303/307) aren't., and different conversion rates make the sum unrealistic.

Do instead: model separate, consolidated, and hybrid paths with explicit retention assumptions and costs.

Making legal or financial conclusions from an SEO review

Why it fails: SEO can identify signals and operational risk but cannot determine ownership, infringement, enforceability, recognized revenue, tax, or fair value.

Do instead: route each flagged issue to counsel, security, accounting, tax, or finance and record the resulting decision.

Tools for SEO due diligence

Patrick’s free tools

• Domain Report: collect bounded public evidence on DNS, registry, hosting, reachability, and safety for every domain in the estate.
• Wayback Change History: compare archived text and page history when a recent redesign, repurpose, or content purge needs context.
• Brand/Non-Brand Splitter: apply and review a brand dictionary against exported query rows locally in the browser.
• Google Search Console CSV Analyzer: pivot supplied page-query exports by URL structureURL structure is how the parts of a web address — scheme, domain, path, query string, and fragment — are organized and formatted. It mostly affects crawling, usability, and how engines understand a page, not rankings directly., topic, CTR, cannibalization, and opportunity.
• SEO Forecast: backtest time-series models, account for seasonality and level shifts, and report prediction intervals instead of a point promise.
• Scout Site Audit Free: run a bounded raw-HTML crawl and group repeatable technical findings with explicit coverage limits.
• Website Safety & Security Checker: collect an outside-in safety snapshot to complement, not replace, Search ConsoleA free Google service that reports how a site performs in Google Search and surfaces problems with how Google crawls, indexes, and serves it. It's first-party data straight from Google — but you don't need it to appear in results. and security review.
• SEO Migration Planner & Validator: plan and verify the redirectA redirect sends browsers and crawlers from a requested URL to a different one. An HTTP redirect specifically is a 3xx status code paired with a Location header; meta refresh and JavaScript redirects achieve a similar navigation without being a 3xx response themselves. Permanent redirects (301/308) are Google's signal the target should be canonical; temporary ones (302/303/307) aren't., sitemapA sitemap is a file that lists the pages, images, videos, and other files on your site so search engines can discover them. It helps discovery, but submitting a sitemap doesn't guarantee crawling or indexing., and old-URL work when the post-deal path includes consolidation.

First-party and specialist systems

• Google Search ConsoleA free Google service that reports how a site performs in Google Search and surfaces problems with how Google crawls, indexes, and serves it. It's first-party data straight from Google — but you don't need it to appear in results. for search performance, indexation, links, ownership, manual actions, security issuesA Google Search Console report that flags signs your site was hacked or hosts content that could harm visitors — phishing, malware, or unwanted software. It's a user-safety flag, not a spam-policy penalty, and you clear it by fixing the problem and requesting a security review., messages, and migration monitoring.
• Analytics, warehouse, CRM, ecommerce, and finance systems for acquisition, outcomes, attribution definitions, revenue, refunds, churn, and contribution.
• Server and CDN logs for botA crawler — also called a spider or bot — is an automated program that fetches web pages, extracts their links, and queues new URLs to visit. Search engines use crawlers to discover and download content for their index. requests, response behavior, old-domain activity, and security investigation evidence.
• A commercial backlink and ranking platform for market context and historical comparison. Obviously I’m biased toward Ahrefs, but no vendor estimate replaces the target’s own data.

Prove the findings before they reach the deal model

Traffic-reconciliation test

• Test to run: Export the same date range and property cohort from Search ConsoleA free Google service that reports how a site performs in Google Search and surfaces problems with how Google crawls, indexes, and serves it. It's first-party data straight from Google — but you don't need it to appear in results., analytics, and the relevant outcome system; align timezones and definitions.
• Expected result: Material differences can be explained by source definitions, consent, attribution, channel rules, redirectsA redirect sends browsers and crawlers from a requested URL to a different one. An HTTP redirect specifically is a 3xx status code paired with a Location header; meta refresh and JavaScript redirects achieve a similar navigation without being a 3xx response themselves. Permanent redirects (301/308) are Google's signal the target should be canonical; temporary ones (302/303/307) aren't., or property scope.
• Failure interpretation: The baseline contains an unresolved measurement or scope gap and should not be treated as verified revenue contribution.
• Monitoring window: Use closed historical periods and exclude the most recent processing window; repeat after any corrected export or definition.
• Rollback trigger: Remove or condition the affected organic claim if the material discrepancy remains unexplained.

Ownership-and-transfer test

• Test to run: Match the asset inventory to registrar, DNS, Search ConsoleGoogle's free tool for monitoring crawling, indexing, and search performance. ownership, CMSA content management system (CMS) is software that lets users create, manage, and publish digital content — like blog posts and pages — without writing raw code. WordPress, Drupal, and Joomla are the most common open-source CMS platforms., repository, vendor, license, and named operating-owner evidence.
• Expected result: Every material property has a confirmed transfer or continued- access path, renewal owner, and post-close operator.
• Failure interpretation: Traffic depends on an asset, credential, contract, or person the buyer may not control.
• Monitoring window: Verify before the decision memo and again against the final transfer schedule.
• Rollback trigger: Exclude the affected contribution or change the recommendation if control of a material asset cannot be established.

Risk-report test

• Test to run: Open the Manual Actions, Security IssuesA Google Search Console report that flags signs your site was hacked or hosts content that could harm visitors — phishing, malware, or unwanted software. It's a user-safety flag, not a spam-policy penalty, and you clear it by fixing the problem and requesting a security review., messages, Page IndexingThe Google Search Console report (formerly Index Coverage) showing how many of your URLs are indexed vs. not indexed, and grouping the not-indexed ones by reason., Links, and Sitemaps reportsThe Google Search Console report where you submit sitemaps and watch how Google processes them — type, last read date, status, and how many URLs were discovered. It confirms Google read your list; it doesn't prove anything got indexed. directly in every material Search Console property.
• Expected result: Current status and history agree with the seller’s disclosures, and any incident has evidence of remediation.
• Failure interpretation: An undisclosed action, security issue, ownership gap, or unexplained history requires specialist review and a revised downside case.
• Monitoring window: Run during diligence and immediately before close if the review period is long enough for status to change.
• Rollback trigger: Escalate or suspend the SEO recommendation when a material action or security issue is unresolved.

Integration-map test

• Test to run: Build a page-level keep, merge, redirect, retire, and rebrand map for material traffic, revenue, and link cohorts.
• Expected result: Each protected URL and legacy brand query has an explicit post-deal destination and owner, with cost and validation steps.
• Failure interpretation: The integration forecast assumes value survives without a plan for overlapping content, redirects, brand demand, systems, or staffing.
• Monitoring window: Before the investment case is approved and again before any migration launches.
• Rollback trigger: Remove unplanned consolidation upside from the model until a feasible, validated migration plan exists.

Prompts for diligence analysis

Reconcile first-party exports without inventing causation

Paste schema descriptions and aggregated rows only after removing personal and confidential data that is not needed for the task.

You are reviewing SEO due-diligence evidence. Compare these Search Console,
analytics, and business-outcome exports for the same properties and date range.

Return:
1. definition, timezone, scope, and granularity differences;
2. reconciled trends that agree across sources;
3. material discrepancies with plausible explanations;
4. evidence needed to distinguish those explanations;
5. claims that remain unsupported.

Do not infer fraud, causation, revenue, or transferability from correlation. Do not
fill missing data. Label every conclusion confirmed, probable, possible, or unknown.

[PASTE DATA DICTIONARIES AND AGGREGATED ROWS]

Turn findings into a decision memo

Convert the following SEO due-diligence findings into a decision memo.

Use these sections: scope and access, verified baseline, evidence gaps,
concentration and dependencies, technical/policy/security/content risks,
integration paths, scenario assumptions, recommendation, conditions, owners,
and next validation tests.

Every headline claim must cite the supplied evidence ID. Keep assumptions separate
from observed facts. Do not make legal, security, accounting, tax, financial-advice,
or valuation conclusions. Preserve uncertainty and do not invent cost or probability.

[PASTE FINDINGS WITH EVIDENCE IDS]

Resources worth your time

My related writing

• The Role of SEO in Mergers and Acquisitions: my overview of target discovery, due diligence, valuation inputs, domain decisions, migration checks, and post-acquisition monitoring.
• What Is an Enterprise SEO Audit and How To Do One: scoping, segmentation, prioritization, and implementation-ready deliverables.
• A Website Migration Takes More Than a Checklist: the operational work behind domain consolidation and post-deal integration.
• SEO Forecasting: building scenarios and communicating uncertainty instead of promising a point outcome.

From around the industry and official sources

• Google: About Search Console data: the limits that matter when reconciling query and page exports.
• Google: Manual Actions report: direct verification of human-issued search actions.
• Google: Security Issues report: hacked content, malware, social engineering, and acquired-site remediation.
• Google: Spam policies: the current policy baseline for scaled content, links, expired domains, and site reputation.
• Google: Disavow links to your site: when the tool may be appropriate and why most sites should not use it.
• Google: Site moves and migrations: the primary integration reference when URLs or domains will change.
• U.S. Copyright Office: Copyright and Artificial Intelligence Part 2: official U.S. analysis of AI-output copyrightability; apply it with counsel.

Test yourself: SEO due diligence

Five questions on evidence, risk, and integration. Pick an answer for each, then check.

Changelog