Ahrefs guesses. Semrush estimates. Google Search Console knows. If you're spending $50,000 or $500,000 on a content site and you haven't spent an hour inside the seller's GSC account, you're buying a story instead of a business. Here's exactly what to pull, what to look for, and what should make you walk.
Deal Alert AI is reader-supported. We earn commissions from affiliate links at no cost to you.
This post is based on a video from our Deal Alert AI YouTube channel. Watch the original or read the full breakdown below.
I've reviewed thousands of online business listings. The single fastest way I've found to separate a real business from a dressed-up one is to ask for read-only Google Search Console access and then spend sixty minutes inside it.
Not Google Analytics. Not a screen-share where the seller scrolls through dashboards while narrating. Not a PDF export. Actual, logged-in, read-only GSC access with 16 months of history in front of you.
Most buyers skip this. They look at the Ahrefs number, they look at the P&L, they look at the Analytics screenshot in the listing, and they call it diligence. Then six months later they're posting in a Facebook group asking why traffic fell 60% and whether anyone else's site "got hit by an update." The signal was usually sitting in Search Console the whole time.
Here's the thing about third-party SEO tools that gets glossed over constantly: Ahrefs and Semrush do not have access to your website's traffic. They never have. What they have is a keyword database, a rank tracker, and a click-through-rate model. They see that a site ranks #4 for a keyword with an estimated 8,000 monthly searches, they apply an assumed CTR for position four, and they multiply. Do that across 4,000 keywords and you get a "traffic" number.
That number can be off by a factor of three in either direction. I've seen sites where Ahrefs estimated 40,000 monthly organic visits and Search Console showed 14,000 actual clicks. I've also seen the reverse — a site with 22,000 real clicks that Ahrefs pegged at 9,000 because most of its traffic came from long-tail queries that weren't in the keyword database. The tools are useful for competitive research and link analysis. They are not evidence.
Google Search Console is different because it's Google's own record of what happened. Impressions are counted when a URL from the site appeared in search results. Clicks are counted when someone actually clicked. There's no model, no estimate, no CTR curve. It's the closest thing to a source of truth that exists in organic search, and it's free for the seller to share.
Key insight: When GSC data and third-party estimates disagree, GSC wins. Always. If a seller is anchoring their asking price to an Ahrefs traffic number that Search Console doesn't support, you've just found your negotiating leverage — or your reason to pass.
We scan Empire Flippers, Flippa, Acquire.com and Quiet Light daily — scoring every listing. Start free.
The first thing to open is the Performance report set to the full 16-month window, which is GSC's maximum lookback. Toggle on both clicks and impressions. Don't filter anything yet. You want the raw shape of the business.
What you're reading here is trajectory. A site doing 30,000 clicks a month that was doing 45,000 a year ago is a very different asset from a site doing 30,000 clicks that was doing 18,000 a year ago — even if both listings say "30K monthly organic visitors." The multiple you'd pay for those two businesses should not be the same, and yet listings routinely present them identically.
Pay specific attention to the relationship between impressions and clicks. If impressions are flat or rising while clicks decline, the site is losing position or losing CTR to SERP features — AI Overviews, featured snippets, People Also Ask boxes eating the click. That's a structural problem that content refreshes may not fix. If impressions are falling too, the site is losing rankings outright, which is usually an update or a link decay issue.
Also look for cliffs. A vertical drop on a specific date almost always maps to a Google core update or a technical event. Cross-reference the date against the Google update timeline. If a site dropped 35% on a known core update date and has been flat since, you are not buying a "temporary dip" no matter what the seller calls it. You're buying the new baseline.
If I could only see one GSC report before buying a site, it would be Queries. This is where the business's actual identity shows up, and where listing copy most often falls apart.
Sort by clicks and look at the top 100 queries. Ask three questions. First: do these queries match the niche the seller claims? A listing that describes itself as a "personal finance authority site" but whose top queries are all celebrity net worth searches is not a finance authority site — it's a celebrity gossip site with a finance domain name, and it monetizes and defends completely differently. Second: how commercial are the queries? Informational queries convert to display ad revenue. Commercial-intent queries ("best X," "X review," "X vs Y") convert to affiliate revenue. A site whose revenue is 80% affiliate but whose queries are 90% informational has a fragile revenue model that depends on a handful of pages.
Third: how much is branded? Filter for queries containing the brand name. If 40% of clicks are branded, you're buying a brand with a real audience and that's genuinely valuable. If branded search is under 3%, you're buying rankings — which are rented, not owned. Neither is disqualifying, but they justify very different multiples.
One more move I use constantly: compare the last 3 months of queries against the same 3 months a year prior. Export both. What disappeared? Sometimes you'll find that the site's traffic total looks stable but the composition has completely changed — the money keywords died and were replaced by low-intent traffic that doesn't monetize. That's a revenue cliff waiting to happen, and it's invisible in the top-line number.
Open the Pages tab, sort by clicks, and do simple math. What percentage of total organic traffic comes from the top 5 URLs? The top 10? The top 20?
My rough thresholds: if the top 5 pages drive more than 70% of organic clicks, that's high concentration risk. If the top 10 drive more than 85%, it's severe. A site with 800 published articles where 6 of them produce 74% of the traffic isn't an 800-article business. It's a 6-article business with 794 pages of overhead — hosting cost, maintenance burden, and thin-content risk.
Concentration matters because a single competitor outranking you, a single core update, or a single broken affiliate program can take out most of the business overnight. I've watched a buyer pay 42x monthly on a site where one comparison page drove 61% of revenue. Nine months later a much larger publisher launched a better version of that page, took position one, and the site's earnings dropped by more than half. Nothing about the site was fraudulent. The seller disclosed everything. The buyer just didn't do the concentration math.
Cross-reference the top pages against the revenue breakdown the seller provides. If page X drives 30% of traffic but 5% of revenue, and page Y drives 4% of traffic but 40% of revenue, your entire risk profile lives on page Y. Go look at that SERP manually. Who else is ranking? How strong are they? Is that position defensible by someone with your resources, or was it defended by a seller with relationships and a link budget you're not inheriting?
Key insight: Traffic concentration and revenue concentration are two different risks and you need to measure both. A site can look diversified on traffic and be terrifyingly concentrated on revenue. The GSC Pages report plus the seller's revenue-by-page breakdown gives you the full picture in about fifteen minutes.
The Pages report under Indexing shows you what Google has indexed and what it hasn't, with reasons. Most buyers ignore this screen entirely. It's one of the few places where diligence can find upside rather than just risk.
Look at the "Not indexed" bucket and read the reasons. "Crawled – currently not indexed" on a large number of URLs usually means Google evaluated the content and decided it wasn't worth including — a quality signal. "Discovered – currently not indexed" often means crawl budget or internal linking issues, which are fixable. "Excluded by 'noindex' tag" might be intentional (tag pages, paginated archives) or might be an accident that's been quietly suppressing a chunk of the site for months.
I once reviewed a site where 340 articles were sitting in "Discovered – currently not indexed" because the sitemap had broken during a migration eight months earlier and the seller never noticed. Those articles represented roughly 25% of total content investment producing zero traffic. That's not a red flag — that's a value-add opportunity you can quantify and use in negotiation. The seller was pricing the business on its current earnings. The buyer bought a fixable technical problem at zero cost.
On the flip side, if you see a huge index bloat problem — thousands of thin tag pages, parameter URLs, or duplicate archives indexed — that's a site with a quality dilution issue that may be capping its rankings. Fixable, but it takes work, and the work should be priced into your offer. Also check the Sitemaps section for submission errors and the Core Web Vitals report for a sense of how much technical debt you're inheriting.
Go to Security & Manual Actions. Check both tabs. This takes eleven seconds and it is the single highest-leverage click in the entire diligence process.
An active manual action means a human reviewer at Google has determined the site violates spam policies and has applied a penalty. Unnatural links, thin content, user-generated spam, cloaking, sneaky redirects — whatever the reason, it means the site's rankings are being actively suppressed and will stay suppressed until the issue is fixed and a reconsideration request is approved. That process can take weeks to months and there's no guarantee of full recovery.
Buying a site with an undisclosed active manual action is one of the worst outcomes in this asset class. You're paying a multiple based on earnings that Google has already decided to take away. And here's the part that catches people: manual actions can be applied after a listing goes live. Check this report at the start of diligence and check it again in the final 48 hours before closing. Same with the Security Issues tab — hacked content, malware, or social engineering flags will tank traffic and require cleanup you didn't budget for.
Warning: A seller who provides GSC access but has "just recently" removed the site from Search Console, or who provides a freshly created property with only a few weeks of data, is showing you a curated view. GSC properties created recently will not have the full 16-month history. If the history is missing and the site is older, ask why — and get the answer in writing before you proceed.
Run this in order. It takes about an hour on a mid-sized content site and it will catch the overwhelming majority of traffic-related problems before you're financially committed.
That last step matters more than people think. If the listing says "45,000 monthly organic visitors per Ahrefs" and GSC shows 19,000 clicks, the asking price was likely built on the wrong number. That's not necessarily fraud — plenty of sellers genuinely believe their Ahrefs dashboard. But the valuation conversation changes immediately, and you should be the one who brings the data.
Treat refusal as a serious red flag. Not automatically disqualifying, but serious enough that the burden of proof shifts entirely to the seller.
Read-only Search Console access costs the seller nothing, exposes no financial data, reveals no customer information on a standard content or affiliate site, and can be revoked in one click. A legitimate owner with a clean site provides it without friction. The most common excuses I hear — "I don't want to give out access before an offer," "the broker has the data," "I'll send you screenshots instead" — are all workable in principle but need to resolve into actual access before money moves.
There is one legitimate exception. Sites where search queries themselves contain sensitive personal information — some health platforms, some legal service sites, some SaaS products with internal search indexed — may have real privacy constraints. In those cases, ask for a supervised screen-share where you drive the navigation and they control the screen, plus full CSV exports of the Performance report. You lose the ability to poke around freely, but you keep the data.
What isn't acceptable is closing on a six-figure acquisition based on screenshots. Screenshots are trivially editable. If a seller's entire traffic verification story rests on images they produced, you have verified nothing. On established marketplaces like Empire Flippers, traffic verification is part of the vetting process before a listing goes live, which reduces this risk considerably. On open marketplaces like Flippa, verification quality varies enormously by listing, so the responsibility for insisting on GSC access falls entirely on you.
The reason I built Deal Alert AI is that the diligence process I just described is expensive to run at scale. An hour per listing is fine when you're looking at five deals. It's impossible when you're monitoring several hundred new listings a month across multiple marketplaces to find the handful worth pursuing.
So we do the filtering upstream. Our system scores listings on a range of signals before they reach subscriber inboxes — including whether verified traffic data is available, whether the listing's traffic claims are internally consistent, how the earnings multiple compares to comparable sales in the same category and revenue band, and whether the listing shows the structural characteristics that historically precede post-acquisition traffic collapse. Listings that fail on verification quality get flagged rather than promoted.
To be clear about what this does and doesn't do: it does not replace your due diligence. Nothing does. We can't see inside a seller's Search Console account any more than you can before they grant access. What we do is make sure the deals that reach you are worth spending your hour on, so that when you do open GSC, you're doing it on a listing that already passed a structural screen instead of one that was never going to survive scrutiny.
The buyers who do well in this market aren't the ones with the best deal flow or the biggest budget. They're the ones with a consistent, boring, repeatable verification process they run on every single deal without exception — and the discipline to walk when the data doesn't support the story. Google Search Console is the cheapest and most reliable part of that process. Use it on every deal. If you want the deal flow already filtered before it hits your inbox, that's what Deal Alert AI is for, and you can see how the scoring works at dealalertai.com.
By Sophal Lanh, Founder of Deal Alert AI
We scan Empire Flippers, Acquire, Flippa, and Quiet Light daily. The best sub-$500K businesses are gone within 48 hours.