Due Diligence Guide

How to Verify Traffic and Keywords Before Buying an Online Business

Updated July 2026 · 9 min read · Deal Alert AI

Traffic is the most frequently misrepresented metric in online business listings. Sellers can cherry-pick time periods, show screenshot-only data, or simply not disclose the full picture. Before any serious offer, you need to independently verify clicks, impressions, rankings, and traffic trends using tools the seller can't manipulate.

Rule of thumb: Never rely solely on data provided by the seller. Always verify with independent third-party tools. The gap between what a seller shows and what third-party tools confirm is often where the real risk lives.

Step 1: Request Google Search Console access

Google Search Console (GSC) shows actual clicks and impressions from Google Search — not estimates. This is the gold standard for content site traffic verification. Request read-only access as part of your due diligence requirement.

What to look for in GSC:

12-month click trend: Is it growing, stable, or declining? A site with declining organic clicks for 6+ months is a red flag unless you have a clear explanation.
Impression-to-click ratio (CTR): Healthy content sites average 3–5% CTR from organic search. Very low CTR could indicate misaligned content targeting.
Query breakdown: What are the top keywords driving traffic? Are they branded (people searching the site name) or unbranded? Unbranded organic traffic is more defensible.
Page breakdown: Are 80% of clicks coming from one article? That's concentration risk — one Google update could wipe it.

Step 2: Cross-check with Semrush or Ahrefs

Third-party SEO tools like Semrush and Ahrefs independently estimate organic traffic using keyword rankings. They won't match GSC exactly (they're estimates) but major discrepancies are a red flag.

What to check:

Organic traffic trend: Does it match what GSC shows? If GSC shows 50K monthly visits but Semrush shows 8K estimated — dig into why.
Domain Rating (Ahrefs) / Authority Score (Semrush): Proxy for how trustworthy Google considers the site. DR 40+ is solid. DR 20 means the site is still building authority.
Keyword rankings: How many keywords rank on page 1 vs page 2? Page 1 rankings drive 90% of clicks. A site with 1,000 page-2 rankings and 5 page-1 rankings is less stable than one with 200 page-1 rankings.
Backlink profile: Are the links natural or do they look like a PBN? Check Semrush backlink audit or Ahrefs referring domains for spam scores.

Step 3: Check the Wayback Machine for history

The Wayback Machine (web.archive.org) shows historical snapshots of a website. This tells you:

When the site was actually built (sellers sometimes claim older history than the site has)
Whether the site has changed niches dramatically (niche shifts reset SEO authority)
Whether there were periods of dormancy or low-quality content

A site that pivoted from adult content to finance in 2022 and is now ranking well is carrying legacy risks that a keyword ranking report won't show.

Step 4: Verify traffic source diversification

Request Google Analytics access (or verify via GA screenshots). Look at the Traffic Sources report to understand the breakdown:

Organic search: SEO traffic. Most defensible.
Direct: Often includes brand traffic and returning visitors. Good sign.
Referral: From other websites. Can be inflated by traffic exchanges.
Social: Platform-dependent. Higher risk if a single platform.
Paid: Red flag if high — means you're buying a media buying operation, not an organic business.

Score any listing before you start DD Our AI analyzes traffic risk from listing descriptions and flags SEO concentration before you spend 20 hours on due diligence.

Step 5: Identify keyword risk concentration

Pull the top 20 keywords driving traffic. Then ask:

Is 60%+ of traffic coming from one or two keywords? High concentration = fragile.
Are those keywords in a niche that could be affected by Google's AI Overviews (reducing clicks for informational queries)?
Are the top keywords product-focused (buyer intent) or informational-only? Product-focused keywords monetize better and are stickier.

Red flags in traffic analysis

Sudden traffic spike in the months before listing (cherry-picked period)
GSC data only available for 3 months (hides longer trend)
Huge gap between GA sessions and GSC clicks (suggests significant non-organic traffic)
Domain shows penalties in Google Search Console coverage report
Ahrefs shows large backlink drops in recent months (link deindexation)
Top keywords are brand searches only (organic traffic not real — it's repeat visitors)

The traffic checklist

Request GSC read-only access — verify 12+ months of clicks and impressions
Run the domain through Semrush and Ahrefs — cross-check organic traffic estimates
Check Wayback Machine — verify age, niche history, content quality
Review GA traffic source breakdown — quantify paid vs organic dependency
Pull top 20 keywords — assess concentration risk and buyer intent
Check for manual penalties in GSC → Security & Manual Actions

Traffic verification isn't the sexiest part of buying an online business. But it's where most of the hidden risk lives. Spend 4 hours on traffic analysis before you spend 10 hours on legal review — it will save you money and time.

Use our free AI deal analyzer to score any listing before your DD starts. It extracts traffic risk signals from the listing description and flags the questions to ask before you dig deeper.