# SEO due diligence: how to check a target's organic traffic before you buy (2026)

> SEO due diligence checks a target's organic traffic before you buy: what to request, bot and GA4 checks, penalties, links, migrations and AI search exposure.

Canonical: https://www.searchmaxxed.com/research/seo-due-diligence
Last updated: 2026-10-28

HOW-TO GUIDE

SEO due diligence checks a target's organic traffic before you buy: what to request, bot and GA4 checks, penalties, links, migrations and AI search exposure.

BH

Brenden House

Founder of Searchmaxxed. We build agentic SEO and GEO workflows that help businesses rank on Google and get named in ChatGPT, then turn that search into more customers and revenue.

PUBLISHED 28 OCTOBER 2026 UPDATED 28 OCTOBER 2026 18 MIN READ

SEO due diligence is a buyer's check of a target company's organic search before a deal closes. It tests four things: whether the traffic is real, whether it earns revenue, what could take it away, and its AI answer exposure. The usual threats are a penalty, a bad link profile, a migration, or a few pages carrying everything. Ask for read-only Search Console and GA4 access, tie organic search to the CRM, and price every risk before you sign.

I'm Brenden House, and I run Searchmaxxed, an SEO and AI SEO agency. I wrote this guide for PE and VC deal teams, corporate development, and the marketing and growth leaders who'll inherit the channel after close.

## In summary

- Verify at the source. A seller's deck and third-party tool estimates are claims. Search Console, GA4 and the CRM are evidence, so ask for read-only access.
- Split brand from non-brand. Branded clicks mostly follow the company. Non-brand clicks are the search asset you're paying for, and Search Console now separates them for you.
- Look for single points of failure. Watch for a manual action, links that break Google's spam policies, a migration nobody planned, or a handful of pages carrying the pipeline.
- Check AI answers too. Ask ChatGPT, Gemini, Perplexity and Google's AI Overviews the target's buyer questions, and note which companies they name.
- Turn findings into deal terms. Each finding should end as a walk-away, a price change, a closing condition or a funded post-close fix.

## What is SEO due diligence?

SEO due diligence is the part of commercial due diligence that puts a value on a target's search channel and the risks around it. It asks how much revenue organic search produces, how durable that revenue is, and what it will cost to keep it after the deal.

In plain terms, due diligence is the checking a buyer does before committing money. The SEO part covers Google's results plus the AI answers above them. It sits beside financial, legal and technology diligence, and it replaces none of the three, however good the search numbers look.

How is it different from an SEO audit? An audit asks what to fix so the site grows, while due diligence asks what you're buying and what could break. The checks overlap: crawling, indexing, content and links get a look in both. But an audit ends in a fix list, and diligence ends in a view on value and risk. If you want the audit side first, our guide to [what an SEO audit checks and what you should get back](https://www.searchmaxxed.com/research/what-is-an-seo-audit) covers it.

Here are the terms you'll see in any SEO diligence report.

| Term | What it means |
| --- | --- |
| Organic traffic | Visits from unpaid search results |
| Non-brand search | Searches without the company's name, such as "SOC 2 compliance software" |
| Manual action | A penalty a human reviewer at Google applies when pages break its spam policies |
| Core update | A broad change to how Google ranks pages, listed on Google's status dashboard |
| Backlink profile | Every link from other websites pointing to the target's site |
| AI visibility | How often AI tools such as ChatGPT name the company when buyers ask for recommendations |

## What should you ask the seller for?

Ask for read-only access to the systems, not screenshots. Exports work as a backup, as long as each one carries its date range and the filters someone applied. Here's a request list to send.

| Ask for | Why it matters |
| --- | --- |
| Read-only Search Console access for every domain and subdomain | Google's own clicks, queries, pages, indexing and the manual actions report |
| Every Search Console export the seller has saved, plus any BigQuery bulk export | The interface shows a limited history; older exports fill the gap |
| Read-only GA4 access, with the event and key event setup | Shows how sessions, leads and sign-ups get counted |
| CRM source fields for leads, opportunities and closed deals | The link from organic visit to revenue |
| A site crawl, URL inventory and redirect maps from past migrations | Technical debt and anything lost in earlier moves |
| A change log: releases, redesigns, platform moves, tracking edits | Explains dips before anyone calls them a penalty |
| Every SEO, content and link agency contract for the past three years | Shows how the links and content were acquired |
| Domain registrar, DNS, hosting and admin account owners | Who controls the assets on day one |
| The content inventory, with authors and licence terms | Confirms the buyer owns what ranks |
| The planned brand, domain and platform changes after close | The biggest post-close risk usually sits here |

Ask the seller to explain every gap in the data, because a missing month in GA4 can have an innocent cause. An unexplained one can't. Ownership of domains and content is a legal question, so your SEO reviewer flags it and counsel answers it.

## How do you check that the organic traffic is real?

Start in Search Console, because Google records those clicks itself. Then hold GA4 against it, and both against the CRM, and only let the deck number into your model once it survives all three.

Search Console counts clicks from Google results, while GA4 counts sessions on the site, so the two never match exactly. That's normal. GA4 growing while Search Console clicks sit flat? That's a gap worth chasing, and it usually means channel groupings, filters, referral spam or bots.

Bots are a bigger problem than most decks admit, and AI channels make it worse. Here's what we found on an enterprise B2B client's account:

> A client's GA4 showed AI-assistant visits jump from 354 to 6,050 in a month. Almost none of it was real. About 5,700 came in three one-hour bursts: same 1920x1080 desktop Chrome, all new users, no referrer, about 20 seconds each, landing on two pages. Real AI traffic was 385 sessions against 354 the month before, roughly flat.

A seller could show that chart in good faith and never know it was wrong. The hourly pattern exposed it. Ask your reviewer to break the target's best months down by hour, device, screen size and landing page.

Conversions break in quieter ways. On another client account we found this:

> A client's four enquiry types never counted as conversions. Their event names ran 41 to 50 characters; GA4 cuts at 40. The 40-character "career" event counted every time. Nobody had noticed, because the events still showed up.

That limit is in [Google's GA4 documentation](https://support.google.com/analytics/answer/9267744): an event name over 40 characters "will not be reported as a key event". Undercounting cuts both ways. It can hide real organic value as easily as bots inflate fake value, so check the event setup before you trust any conversion rate.

Finally, follow organic leads into the CRM. Count opportunities and closed revenue with organic as the source, by landing page, because that's the number your model needs. Third-party tools like Semrush and Ahrefs estimate traffic from rankings, which makes them useful for competitors and for a first look before access. Confirming a seller's figures is beyond them.

## How much of the traffic is brand, and how concentrated is it?

Split branded from non-branded clicks first, then measure how much depends on a few pages, queries or markets. A business whose search traffic is mostly its own name owns a brand, and brands travel with the company whatever you do to the site. Unbranded traffic is the search asset you're valuing.

Search Console now does the split for you. Its Performance report has a [branded and non-branded queries filter](https://support.google.com/webmasters/answer/17011259), and Google says the filter's history starts from March 2025. It won't work for low-impression sites, and Google warns it can put some queries in the wrong bucket. Spot-check it against your own brand terms.

Then run the concentration checks, page by page and query by query:

| Check | What to look at | What should worry you |
| --- | --- | --- |
| Page concentration | Share of non-brand clicks on the top 5 and top 20 URLs | A few pages carry most of the non-brand pipeline |
| Query concentration | Share of clicks from the top 20 non-brand queries | One topic cluster carries the business |
| Market concentration | Clicks and leads by country | The growth story needs markets that barely appear today |
| Page type | Product, comparison, integration, blog, docs | Revenue rests on page types AI answers now cover |
| Trend by segment | Brand and non-brand over every month available | Brand rising while non-brand falls behind it |

Treat page concentration like customer concentration. If five comparison pages bring most of a B2B SaaS company's demo requests, each one is a key account. Find out who wrote them. Then find out who keeps them current, and what your integration plan does to their URLs, templates and internal links.

## Has the site been penalised or hit by a Google update?

Check the Manual actions report in Search Console, then match every traffic drop against Google's confirmed updates and the target's change log. A manual action is a known penalty. A drop that lines up with a core update points to page quality; one that lines up with a release usually means a technical fault.

Google's [Manual actions report](https://support.google.com/webmasters/answer/9044175) shows any current action and the site's history. Google says that "if a site has a manual action, some or all of that site will not be shown in Google search results". You'll see it once you have access. An old, lifted action can be survivable. Find out what caused it and confirm the cause has gone.

Updates leave no message. You match dates instead, and the [Google Search Status Dashboard](https://status.search.google.com/products/rGHU1u87FJnkP6W2GwMi/history) lists every confirmed ranking update. In 2026 so far, Google has confirmed two core updates, in March and May, and four spam updates. A target that lost a third of its non-brand clicks within days of the May core update has a quality question to answer.

Google's [spam policies](https://developers.google.com/search/docs/essentials/spam-policies) name the tactics to look for, and three of them matter most when you're buying a company:

- **Scaled content abuse.**  Google defines it as "many pages are generated for the primary purpose of manipulating search rankings and not helping users", however someone produces them.
- **Site reputation abuse.**  Third-party pages hosted on a strong domain to borrow its ranking power, such as sponsored coupon or review sections.
- **Expired domain abuse.**  Old domains bought and repurposed to rank low-value content on the strength of their history.

A site can grow fast on any of these and then fall hard. Those growth charts need the most explaining.

## What does the backlink profile tell you?

The backlink profile tells you whether the target earned its rankings or bought them, and whether those links will still count after the deal. Look at who links, why they link and how the target got the links.

Pull the profile from at least two link tools, then read the agency contracts beside it, because the invoices often explain the patterns. Watch for these:

| Pattern | Why it matters |
| --- | --- |
| Keyword anchor text, such as "best payroll software", across unrelated sites | Looks bought; a spam update can discount it |
| Links from networks of near-identical sites with no audience (PBNs) | Breaks Google's link spam policy |
| A burst of new linking domains matching an agency's start date | Points to a paid campaign |
| Partner pages, founder columns and integration directories | Can leave with a founder or a partnership |
| Links to pages you plan to delete or merge | Lose value without proper redirects |

Spam links that nobody bought do turn up, and on their own they rarely sink a deal. What matters is a paid link scheme the target ran itself. Ask for the invoices. A line item for "guest posts" or "link packages" tells you more than any toxicity score.

## What migration and integration risks should you price?

Price any planned change of domain, brand, platform or URL structure before you close. Integration is where the buyer's own decisions put the traffic at risk. A migration that drops redirects or changes thousands of URLs at once can wipe out the asset you just bought.

Google's [site move guidance](https://developers.google.com/search/docs/crawling-indexing/site-move-with-url-changes) is plain: keep redirects "for as long as possible, generally at least 1 year". When moving between domains, submit a Change of Address in Search Console. So ask two questions. Did the target's past migrations keep their redirects? And does your own plan keep them for at least a year after the move?

Each common integration plan carries its own risk:

| Integration plan | What can go wrong | What to ask for before close |
| --- | --- | --- |
| Keep the target's site as it is | Little, if access and hosting transfer cleanly | Admin access, hosting and deployment owners |
| Fold the target's site into yours | Pages lose rankings when merged without a URL-level plan | A redirect map for every page with clicks or links |
| Rebrand the target | Branded search demand resets; links point to an old name | Brand search history and a rebrand plan |
| Move to a new platform | Rendering, speed, structured data and tracking break | A staging crawl and tracking test before launch |
| Roll up several sites | Overlapping pages compete for the same searches | A page-by-page keep, merge or remove list |

If the plan includes a new name, read our guide to [protecting SEO through a rebrand](https://www.searchmaxxed.com/research/rebrand-seo). Moving the site? Our [site migration SEO checklist](https://www.searchmaxxed.com/research/site-migration-seo-checklist) covers the URL mapping and launch checks.

## How exposed is the target to AI search?

Test it directly: put the target's buyer questions to ChatGPT, Gemini, Perplexity and Google's AI Overviews, and record which companies they name. Then check how much of the target's organic traffic comes from informational queries that AI answers now resolve without a click.

The click risk is measurable. The [Pew Research Center](https://www.pewresearch.org/short-reads/2025/07/22/google-users-are-less-likely-to-click-on-links-when-an-ai-summary-appears-in-the-results/) tracked the browsing of 900 US adults in March 2025. Users clicked a traditional result in 8% of visits that showed an AI summary, and in 15% of visits without one. Longer searches and full questions triggered AI summaries more often. A target living on "what is" and "how to" blog traffic carries more exposure than one ranking for "pricing" and "vs" pages.

There's an upside too. Pages need no special work to appear in AI Overviews or AI Mode, according to Google. Its [guidance on AI features](https://developers.google.com/search/docs/appearance/ai-features) says "all existing SEO fundamentals continue to be worthwhile". So a target with clean technical SEO and good pages is ready, while one with crawl blocks or thin pages has work to do first.

Which companies AI answers name depends heavily on what other websites say about them, as our own ChatGPT testing showed:

> Across 900 ChatGPT answers about Australian agencies, a single third-party "best agencies" site was cited in 168 of them. The next three were a second listicle, Semrush's agency directory and Clutch. If you want to be recommended, the job is getting onto the handful of pages the model already trusts.

So in diligence, record which outside pages the AI answers cite for the target's category, and check whether the target appears on them. A target missing from those pages has a gap you can close after the deal. Our guide on [how to track AI visibility](https://www.searchmaxxed.com/research/how-to-track-ai-visibility) sets out a repeatable test. One run proves little, because answers change from run to run.

## What findings should change the price or stop the deal?

Sort every finding into one of four outcomes: walk away, change the price, ask counsel for protection, or fix it after close with a budget. A list of 400 crawl errors helps nobody on an investment committee. A short table does.

| Finding | What it usually means | Typical deal outcome |
| --- | --- | --- |
| Active manual action on core pages | Part of the site is suppressed now | Walk away, or make removal a condition for counsel |
| Growth built on scaled or bought content and links | Rankings at risk at the next spam update | Price the traffic at the level clean pages support |
| Organic "growth" that is mostly bots or mislabelled channels | The deck overstates the channel | Restate the base case from Search Console and CRM |
| Most non-brand pipeline on a few pages | Concentration risk | Price it like customer concentration; protect those pages first |
| Conversions undercounted in GA4 | The channel may be worth more than reported | Recount from the CRM; fix tracking in week one |
| Migration planned without a redirect map | High post-close loss risk | Budget the migration work before close |
| Absent from AI answers in a category where competitors appear | Growth gap, not a defect | Put it in the value creation plan |
| Seller staff or agency hold the domain or admin accounts | Control risk | Transfer of access as a closing item for counsel |

The last column is the point. Every SEO finding should end up as a number in the model, a condition in the purchase agreement or a line in the 100-day plan.

## A worked example: one B2B SaaS target

Take a growth-stage B2B SaaS company. I've invented the figures to show the method; they don't describe a client.

The deck says organic search brings 60,000 sessions a month and 40% of demo requests. With access, here's what the checks find:

| Check | What it shows |
| --- | --- |
| Search Console | 21,000 clicks a month; the branded filter puts 12,000 on the company's name, leaving 9,000 non-brand |
| GA4 | An "AI traffic" spike last quarter turns out to be three bursts from one device type; real AI traffic is flat |
| Concentration | Four comparison pages and one integrations page bring 70% of non-brand clicks |
| CRM | Organic deals are real and close well; two demo event names run past 40 characters, so GA4 undercounts organic by about a quarter |
| Links | Mostly earned through integrations and partners, plus one 2023 guest-post package |
| AI answers | Two competitors appear for the main buyer questions; the target appears in one engine out of four |
| Integration plan | Moves the target onto the parent's domain within six months, with no redirect map yet |

The result? The traffic is smaller than the deck claims but better than it looks, because GA4 undercounts its conversions. The real risks are five pages and a migration. So the buyer prices the channel from Search Console and CRM figures and writes the redirect map into the plan before any domain change. AI visibility becomes a growth line.

## How long does SEO due diligence take, and what does it cost?

Expect anywhere from 48 hours for a fixed-price report to three or four weeks for an investment committee review. Published prices run from $119 to $15,000 and up. Deal size, access and the depth of forecasting drive the difference, and so does how much of the work a person does by hand.

This is my own selection of providers that publish a price for SEO or website due diligence, and I run Searchmaxxed, so it's listed first. It's a price map, not a ranking.

| Provider | What they sell | Published price | Turnaround they state |
| --- | --- | --- | --- |
| Searchmaxxed | AI SEO Audit of Google rankings, AI answers, technical SEO and links | Not published; quoted per company | Five business days |
| [Dealytix](https://www.dealytix.com/content) | Scored reports for content-site deals of about $25K to $1M | $119 Quick Score; $599 Full Report | Within 48 hours |
| [WebAcquisition](https://webacquisition.com/due-diligence/content-website/) | 22-point content website due diligence report | $2,490+ | Within 7 business days |
| [John McAlpin](https://www.johnmcalpin.com/services/m-a-digital-due-diligence/) | Pre-LOI, full and investment committee SEO diligence | From $3,500, $7,500 and $15,000 | 3 calendar days; 2 to 3 weeks; 3 to 4 weeks |

Prices and turnarounds come from each provider's own page, read 27 October 2026 (AEST). None names a currency.

The cheaper reports suit small content-site purchases. A platform deal or a company with a sales team needs access-based work: Search Console, GA4, the CRM and interviews with the channel's owners. So compare quotes on the same asset list, access and deadline.

## Where does Searchmaxxed fit?

Searchmaxxed is an SEO and AI SEO agency for enterprise, B2B SaaS, venture-backed, manufacturing and public-sector companies. In a deal, we do two jobs. Before close, we check the target's search channel; after close, we run the work that protects and grows it.

**Before close: the AI SEO Audit.**  We run the [AI SEO Audit](https://www.searchmaxxed.com/services/seo-audits) for companies in Australia and the US. Five business days. It starts with a thirty-minute call with the people who would do the work. If the target shares Search Console and rankings, we open them live on that call. You get one document in four parts, walked through live:

1. A map of where buyers search without finding the target, with its Google rank and AI answer presence beside each search.
2. A read on what the site is doing to itself: crawl blocks, index faults, pages competing for one search, thin buying pages.
3. Every fix ranked by what it's worth.
4. The plan.

The map includes what ChatGPT, Gemini, Perplexity and Google's AI Overviews say, and which sources they lean on. For a deal team, the plan becomes your post-close plan. Without access, we can still read the public side: rankings, competitor pages, links and AI answers. The traffic and conversion checks need Search Console, GA4 and the CRM, so we'd ask for those the moment the seller allows it.

**After close: the managed packages.**  Each one includes ongoing audits, a 90-day plan in weekly releases, the build work itself and a monthly decision memo. The company owns the site, repository, content and data from day one, which matters when a portfolio company changes hands again.

| Package | Who it suits after a deal | What it includes |
| --- | --- | --- |
| Growth System | A portfolio company growing in one or two markets | 30 page releases a month, work on up to 4 existing pages, one qualified link action, AI visibility tracking |
| Agentic Search Engineering | A crowded or national category | 50 page releases a month, comparison and industry pages, digital PR and link campaigns, AI answer tracking across ChatGPT, Gemini, Perplexity and AI Overviews |
| Custom & Enterprise | Roll-ups, several brands or several markets | Dedicated engineering, custom reporting and original first-party research |

Here's how we do it. We build on a website the company owns, our Agentic Website. AI agents pull its Search Console and GA4 data, read the Google results and check what AI answers say about it and its competitors. That feeds the Managed Search Loop, which shows which page, fix or link should bring in the most enquiries next. We build it, check the live page and measure what changed. Off the site, the Off-Page Source Layer builds the links, digital PR and mentions AI answers draw on.

Searchmaxxed's work has generated more than A$10 million in revenue through search for its clients.

## Is Searchmaxxed right for you?

We fit when search and AI answers sit inside the deal thesis and you want one team to check the channel, then grow it. Need a financial, legal or valuation opinion? Wrong call. Those belong with your accounting firm and counsel.

| Searchmaxxed is a good fit if | Look elsewhere if |
| --- | --- |
| The target's pipeline leans on organic search or AI answers | Search is a minor channel for the target |
| You want the target's Google rankings and AI answers checked together | You need a quality-of-earnings report or a legal opinion on ownership |
| You want findings ranked by what they're worth, ending in a plan | You want a scored PDF for a small content-site purchase within 48 hours |
| A migration, rebrand or roll-up follows close and someone has to build it | You only want a one-off report and no help after close |
| The marketing or growth team wants direct access to the people doing the work | You need the review done without any target data and can't get access |

If you're in the right-hand column, one of the specialists in the price table will serve you better.

## Frequently asked questions

### What is SEO due diligence?

SEO due diligence is a buyer's check of a target company's organic search before a deal. It confirms the traffic is real and ties it to revenue. It also finds the risks, from penalties and bad links to concentration, migrations and AI answer exposure.

### What's the difference between an SEO audit and SEO due diligence?

An SEO audit finds what to fix so a site can grow. SEO due diligence uses many of the same checks to decide what a buyer is paying for and what could go wrong. Its output is a view on value and risk rather than a fix list.

### What data should a buyer request for SEO due diligence?

Start with read-only Search Console and GA4 access, saved Search Console exports and CRM source fields. Then ask for the crawl and redirect history, a change log, agency contracts, and the names of whoever holds the domains and admin accounts.

### Can you do SEO due diligence without access to the target's analytics?

Partly. You can read rankings, competitor pages, backlinks and AI answers from outside. Third-party traffic figures are only estimates, though. A manual action shows up in Search Console alone, so confirm the numbers with access before you close.

### How do you check if a website has a Google penalty?

Open the Manual actions report in the target's Search Console. Google lists current actions and history there. Then match traffic drops against Google's confirmed updates on its Search Status Dashboard, and against the target's own release log.

### How long does SEO due diligence take?

Published turnarounds run from 48 hours for fixed-price content-site reports to three or four weeks for investment committee work. Searchmaxxed's AI SEO Audit takes five business days.

### Does AI search lower the value of organic traffic?

It can, for traffic from informational searches. Pew found users clicked a result in 8% of visits with an AI summary and 15% without. Pricing, comparison and product searches carry less of that risk, so check the mix.

## What should you do next?

Send the request list above to the seller this week. Then put the target's top buyer questions to ChatGPT, Gemini, Perplexity and AI Overviews, and save the answers, well before your decision date. If you want us to run the check and build the post-close plan, [let's talk pricing](https://www.searchmaxxed.com/contact).

REFERENCES

1. [Google's GA4 documentation](https://support.google.com/analytics/answer/9267744)
2. [branded and non-branded queries filter](https://support.google.com/webmasters/answer/17011259)
3. [Manual actions report](https://support.google.com/webmasters/answer/9044175)
4. [Google Search Status Dashboard](https://status.search.google.com/products/rGHU1u87FJnkP6W2GwMi/history)
5. [spam policies](https://developers.google.com/search/docs/essentials/spam-policies)
6. [site move guidance](https://developers.google.com/search/docs/crawling-indexing/site-move-with-url-changes)
7. [Pew Research Center](https://www.pewresearch.org/short-reads/2025/07/22/google-users-are-less-likely-to-click-on-links-when-an-ai-summary-appears-in-the-results/)
8. [guidance on AI features](https://developers.google.com/search/docs/appearance/ai-features)
9. [Dealytix](https://www.dealytix.com/content)
10. [WebAcquisition](https://webacquisition.com/due-diligence/content-website/)
11. [John McAlpin](https://www.johnmcalpin.com/services/m-a-digital-due-diligence/)

[Get an AI visibility audit](https://www.searchmaxxed.com/contact)

See where buyers find someone else across Google and AI answers.

See where you are invisible →

## Let's make you the answer.

## Related

- [Research](https://www.searchmaxxed.com/research)
- [Searchmaxxed](https://www.searchmaxxed.com/)