Buyer's Guide

Buying an existing business? Audit the website before you close

Most Colorado small-business acquisitions include the website, the GBP, and the brand — but buyers almost never audit any of them during due diligence. Here's the 30-minute audit that's saved buyers from inheriting Google penalties, expired domains, and review profiles owned by an ex-employee.

By Chris Heidlebaugh, Owner9 min readPublished

The 30-minute pre-LOI audit

Run this before you sign a letter of intent. It catches the dealbreakers cheap.

1. Domain ownership and renewal

  • Run a WHOIS lookup — is the owner the seller, a defunct agency, or an ex-spouse?
  • Check expiration date. A domain expiring in 60 days is leverage in negotiation.
  • Confirm registrar account credentials will transfer at closing.

2. Google Business Profile

  • Search the business on Google Maps. Does the listing have the right phone, hours, photos, and review count the seller claims?
  • Ask the seller to send a screenshot of the GBP dashboard showing owner email — confirm it transfers.
  • Count reviews in the last 90 days. A listing with no recent reviews is a listing that's stopped driving calls. Why review velocity matters.

3. Website traffic and rankings (the real ones)

  • Demand Google Analytics 4 and Google Search Console access for 24+ months. Verify the seller's traffic claims yourself.
  • Look for the classic seller red flag: traffic that fell off a cliff 3–12 months ago. That's usually a Google update they never recovered from.
  • Use Search Console to check for manual actions — penalties that follow the domain.

4. Backlink profile

  • Run the domain through Ahrefs, Semrush, or Moz (free trials work).
  • Look for: sudden spikes in backlinks (paid link networks), foreign-language spam links, anchor text stuffed with keywords like "best plumber Denver."
  • A clean backlink profile is an asset; a toxic one is a liability that needs disavow work. Related technical debt.

5. The website itself

  • Run PageSpeed Insights on mobile. Score under 50 = significant rebuild needed.
  • Check the CMS. WordPress on outdated hosting is fixable. Custom code with no documentation from a developer who's vanished is not. Platform context.
  • Look for SSL, mobile usability, and broken contact forms — test the form from your phone before closing.

6. Reviews and reputation

  • Google, Yelp, Facebook, BBB, industry-specific sites — search the business name on each.
  • Pattern of recent 1-star reviews about service quality = the seller is selling because the wheels are coming off.
  • Negative news search. A 5-minute Google News search has saved buyers from lawsuits-in-progress.

Closing-day digital handover checklist

Get all of this in the closing documents, not over text:

  • Domain registrar account transfer
  • Hosting account credentials and billing
  • CMS / website admin logins
  • Google Business Profile primary owner transfer (initiated before closing — Google has a 7-day delay)
  • Google Analytics + Search Console property access
  • Google Ads account access (if applicable)
  • Email hosting credentials
  • Social media account credentials
  • Review platform logins (Yelp, BBB, industry directories)
  • CRM, booking, and call-tracking account access

First 30 days after closing

  • Change every password and revoke old user accounts (especially the previous owner's email).
  • Update GBP photos, hours, and post a "new ownership" announcement.
  • Submit the existing sitemap to Google Search Console under your account.
  • Do NOT redesign the website in month 1 — wait 90 days. Major changes to a stable ranking site can tank rankings overnight.
  • Audit and disavow toxic backlinks if Ahrefs flagged any.

Related guides

Work with us

Have questions this article didn't answer?

Book a no-pressure 30-minute call with Chris, the owner. If we’re not a fit, he’ll tell you who is.