Note

SEO Due Diligence Is Just Kicking the Tires (And Nobody Knows Where the Tires Are)

A framework for evaluating organic traffic before you write the check.

Amos Weiskopf

April 7, 2026

The call came at 9:14 PM on a Wednesday, which I know because I was already in bed (not sleeping, scrolling my phone with the particular dead-eyed focus of a man who has read every interesting thing on the internet and is now reading the uninteresting things, because the alternative is putting the phone down and confronting the silence, which is a whole other problem). The number was unfamiliar. I answered anyway, because I'm a consultant, and consultants answer unfamiliar numbers at 9 PM the way Pavlov's dog salivated at bells - it's not a conscious decision, it's a conditioned response to the possibility that someone might need to give me money.

\"Amos,\" said a voice I didn't immediately recognize, \"it's Brian.\" A pause. \"Brian Kowalski. From the Meridian deal.\" Another pause, as if he was giving me time to place him, which I needed, because I'd worked on exactly one project with Brian Kowalski and it was eighteen months ago and the project had been unremarkable enough that his voice hadn't made it into my permanent memory. \"The PE guy,\" he added, which was the detail that unlocked it: a growth equity firm, a SaaS platform they were evaluating, a quick-and-dirty content audit I'd done as part of their commercial due diligence.

\"Brian. Right. What's up?\"

\"We're closing on something. Thursday. Maybe Friday.\" This was Wednesday night. \"The organic traffic number is - it's a big part of the thesis. Can you tell me if it's real?\"

Can you tell me if the organic traffic is real. In 72 hours. On a company I've never looked at, in an industry I'd need to research, with no access to their analytics, their Search Console, their backlink profile, or their content strategy. Can I tell you if the organic traffic is real.

No. I can't. Not in 72 hours. Not with certainty. Not in the way that would justify a \"yes\" or \"no\" that might influence a multi-million dollar investment decision.

But here's what I can tell you, Brian. Here's what I can tell anyone in this position, and the \"anyone\" is growing, because every PE firm, every growth equity firm, every late-stage VC that I've worked with in the past five years has eventually found themselves in exactly this spot: staring at an organic traffic number in a financial model and not knowing whether the number is a load-bearing beam or a painted wall.

What follows is the framework. Not the 72-hour version (though I'll tell you what to prioritize if that's all you've got). The real version. The one that takes two to three weeks and that should be standard practice in every acquisition where organic search traffic represents more than 15% of revenue or more than 25% of the customer acquisition pipeline.

It isn't standard practice. At most firms, SEO due diligence consists of someone glancing at a SimilarWeb graph and saying \"traffic looks stable.\" That's not due diligence. That's vibes.

Why This Matters More Than You Think

Let me give you a number that should make you uncomfortable: across the fourteen PE-backed companies I've worked with post-acquisition, the average decline in organic traffic during the first twelve months of ownership was 31%. Thirty-one percent. Not because the companies were poorly managed. Not because the PE firms were incompetent. Because nobody, during the due diligence process, had mapped the organic ecosystem well enough to understand what was fragile, what was load-bearing, and what was safe to change.

The organic traffic number in a financial model is not a fact. It is a snapshot of a dynamic system at a specific point in time. It's like measuring the height of a wave and assuming that's the permanent water level. The number tells you what organic traffic is today. It tells you nothing about why the traffic exists, how stable it is, how dependent it is on specific pages or people or technical configurations, or how it will respond to the changes that every acquisition inevitably brings.

SEO due diligence is the process of answering those questions. The fact that most firms skip it, or do it badly, or cram it into 72 hours, is one of the primary reasons that organic traffic declines post-acquisition. You can't protect what you don't understand, and you can't understand an organic traffic profile by glancing at a graph.

The Traffic Quality Audit

The first thing I do - and the thing you should do even if you only have 72 hours - is figure out whether the organic traffic number in the model is actually worth what the model says it's worth. Because not all organic traffic is created equal, and the distance between \"100,000 organic sessions per month\" and \"100,000 organic sessions per month that actually generate revenue\" can be enormous.

Branded vs. non-branded split. This is the single most important metric in any organic traffic due diligence, and it's the one that gets overlooked most often. Branded traffic is people searching for the company's name (or close variations of it). Non-branded traffic is people searching for topics, problems, products, or categories and finding the company in the results. Both are organic. They are not the same.

Branded traffic is a function of brand awareness. It's driven by advertising, PR, word-of-mouth, direct marketing. If the company is running $2 million a year in brand advertising, a significant chunk of their \"organic\" traffic is actually a downstream effect of that ad spend. Cut the ads, lose the traffic. This isn't a hypothetical - I've seen it happen. A B2B company that was acquired, had its brand ad spend reduced as a \"cost optimization,\" and then saw 40% of its organic traffic disappear over six months. The organic traffic wasn't organic. It was branded search that existed because the ads existed.

The non-branded traffic is what you actually want to understand, because non-branded traffic is the traffic that represents genuine organic discovery - people finding the company through Google without already knowing it exists. This is the traffic that has real SEO equity behind it. This is the traffic that's defensible (or vulnerable) based on the company's content, links, and technical foundation.

If the branded/non-branded split is 70/30 in favor of branded, the organic traffic number in the model is significantly overstated as an SEO asset. It's mostly a brand asset dressed up in organic clothing. Not worthless, but not what it looks like.

If the split is 30/70 in favor of non-branded, the organic traffic is the real deal - genuine search visibility that the company has earned through content and authority. This is more valuable but also more fragile, because it's dependent on rankings that can shift.

You can estimate this split without access to the company's Search Console. Use Semrush or Ahrefs. Pull the top keywords driving traffic. Separate them into branded and non-branded. It's not perfect, but it's close enough for due diligence.

Geographic distribution. Where is the traffic coming from? If the company operates in the US and 35% of its organic traffic is from India, Pakistan, and the Philippines, you have a problem. Not because there's anything wrong with traffic from those countries, but because if the company's revenue model depends on US customers, a third of the organic traffic number in the model is non-converting. I've seen this pattern multiple times, usually on sites that have a large blog or knowledge base that ranks globally for informational queries. The traffic is real. It's just not worth what the model assumes it's worth.

Page-level concentration risk. This is the one that scares me the most when I find it, and I find it more often than I'd like. Pull the top pages by organic traffic. What percentage of total organic traffic is concentrated in the top 10 pages? The top 20? The top 50?

A healthy organic traffic profile is distributed across hundreds or thousands of pages. No single page should represent more than 5-8% of total organic traffic. If you see concentration, you're not looking at a stable traffic source. You're looking at a house of cards with a very specific set of cards holding the whole thing up.

The Five Post-Acquisition Killers

The traffic quality audit tells you what you have. The next step is understanding what you're likely to lose. Because acquisition changes things, always, and the question isn't whether organic traffic will be affected but how much and in what ways.

I've written at length about these in another piece, but for the purposes of due diligence, here's the assessment framework for each.

1. Brand confusion. Is the company being rebranded? Is the name changing? Is it being folded into a parent brand? Any change to the brand identity creates a gap between the brand signals Google has accumulated (mentions, anchor text, knowledge graph data) and the new brand identity. Assess: is a rebrand planned? If yes, how significant? A visual refresh is low-risk. A name change is high-risk. A domain change is nuclear.

2. URL changes. Is a site migration planned? CMS change? Domain change? URL restructuring? Any of these will cause organic traffic disruption. The question is how much. Assess: what's the migration scope? How many URLs will change? Is there institutional knowledge of previous migration attempts? (Many companies have botched migrations in their history that they've learned from. If those lessons walk out the door with departing staff, you'll make the same mistakes again.)

3. Content consolidation. Is the new ownership likely to \"rationalize\" the content? Delete old blog posts? Merge pages? Rewrite content to match new brand guidelines? All of these actions carry organic risk. Assess: how distributed is the content's organic value? If 200 blog posts each drive a small amount of traffic, consolidating them into 20 \"pillar pages\" will likely cause significant loss, even with perfect redirects. Map the long-tail value before anyone starts consolidating.

4. Technical debt assumptions. Every website has technical debt. The question is whether the technical debt is actually hurting performance or whether it's just ugly. I've seen PE operations teams spend six months and $500,000 fixing \"technical SEO issues\" that weren't actually affecting rankings. Meanwhile, the changes they made to fix the non-issues introduced new issues that were affecting rankings. Assess: run a technical crawl (Screaming Frog, Sitebulb). Identify genuine technical issues vs. cosmetic ones. Prioritize issues that are actually correlated with traffic decline, not just issues that show up as red in an audit tool.

5. Team departure. Who built the organic traffic? Who maintains it? Are they staying? This is, in many ways, the most important variable in the entire due diligence, and it's the one that gets the least attention because it doesn't show up in a tool or a dashboard. It shows up in an org chart and an employment contract.

The Bus Factor

In software engineering, the \"bus factor\" is the number of people on a team who would need to be hit by a bus before the project grinds to a halt. A bus factor of one means that if one specific person disappears, everything breaks. In software, a bus factor of one is considered a critical risk. In SEO, a bus factor of one is considered normal.

Most companies' organic traffic was built by one person, or a very small team, over a long period. That person (or team) holds institutional knowledge that is almost never documented. They know which pages to update and when. They know which backlinks are driving the most value. They know the history of every technical decision, every content strategy pivot, every algorithm update recovery. They know where the bodies are buried, to use a metaphor that's uncomfortably appropriate in the M&A context.

Your due diligence should include a specific assessment of the SEO bus factor. How many people are involved in organic? What does each person do? Is any of it documented? Are there SOPs for content production, technical maintenance, link building? If the answer to any of these is \"no\" or \"I don't know,\" that's a risk factor that should be modeled into the deal, the same way you'd model the risk of losing a key salesperson or a key engineering lead.

Ask to interview the person responsible for SEO. Ask them specific questions. Not \"what's your SEO strategy?\" (they'll give you a rehearsed answer designed to sound good in a due diligence context). Ask them: \"If you left tomorrow, what would break first?\" That question will tell you more about the organic traffic's vulnerability than any tool or dashboard.

The Red/Yellow/Green Framework

I categorize due diligence findings into three buckets: red flags (material risk to the organic traffic thesis), yellow flags (moderate risk that can be managed with proper planning), and green flags (indicators of a healthy, defensible organic position). Here's what I look for in each.

Red flags - any one of these should cause you to adjust the organic revenue projection downward or build a significant contingency into the model:

Traffic is more than 60% branded. The organic number is a brand metric, not an SEO metric. It will decline if brand spend is reduced post-acquisition.

More than 50% of organic traffic is concentrated in fewer than 10 pages. Extreme concentration risk. One algorithm update could wipe out half the organic revenue.

The primary traffic-driving content hasn't been updated in more than 18 months. Stale content loses rankings. If nobody's maintaining the content, the traffic is on borrowed time.

A major site migration is planned for the first 6 months post-close. Even well-executed migrations cause organic disruption. On a compressed PE timeline, the disruption is almost always worse than projected.

The SEO bus factor is one, and that person is not under a retention agreement. You're one resignation away from losing the institutional knowledge that keeps the organic traffic alive.

The backlink profile is dominated by a single source or a small number of sources. If 40% of your referring domains come from one partnership, one PR placement, or one content syndication deal, and that relationship changes post-acquisition, you lose 40% of your link equity.

Green flags - indicators that the organic traffic is defensible and likely to survive the transition:

Traffic is more than 60% non-branded, distributed across hundreds of pages. This is a genuine organic asset with low concentration risk.

Content is actively maintained - regular publishing, regular updates to existing content, clear editorial calendar. Someone is tending the ecosystem.

The backlink profile is diverse - hundreds of referring domains, no single source dominating, organic link acquisition from genuine editorial mentions. This is a link profile that can survive changes.

The SEO team has more than one person, documented processes, and retention agreements in place. Institutional knowledge is distributed and preserved.

No major technical migration is planned in the first 12 months. The current infrastructure, however imperfect, is stable and functional. There's time to understand the system before changing it.

The site has survived previous Google core updates without significant decline. This is the closest thing to a stress test you'll find. A site that's weathered multiple core updates has genuine authority that's unlikely to evaporate.

The Actual Tools and Queries

Here's what I actually run during a due diligence engagement, in roughly the order I run it. Some of these require paid tools. Some don't. All of them are worth doing.

Semrush or Ahrefs organic traffic trend. Pull the 24-month trend. You're looking for stability, growth, or decline. But more importantly, you're looking for volatility - sharp spikes and drops that correlate with Google core updates (which you can cross-reference against the Google Search Status Dashboard). A site that drops 20% after every core update and then recovers is in a different risk category than a site that's been flat for two years. Both might show the same current traffic number. The history tells you which one is standing on solid ground and which one is standing on a trapdoor.

Branded vs. non-branded keyword split. In Semrush: Organic Research > Positions > filter by branded/non-branded. In Ahrefs: Site Explorer > Organic keywords > filter by brand terms. Export both lists. Calculate the traffic split. If the tool's estimate of total organic traffic is 80,000 sessions and 50,000 of those are branded, you've just cut the \"real\" organic asset value by 62%.

Top pages by organic traffic. Pull the top 50 pages by estimated organic traffic. Calculate concentration. I make a simple distribution chart: what percentage of traffic goes to the top 5, top 10, top 25, top 50 pages. I compare this to the total number of pages on the site that receive any organic traffic at all. A site with 5,000 indexable pages where 80% of traffic goes to 20 pages has a very different risk profile than a site with 5,000 pages where the traffic is distributed across 2,000 of them.

Backlink profile analysis. In Ahrefs: Site Explorer > Backlinks > Referring Domains. I look at three things. First, total referring domains and the trend over time (growing, stable, declining). Second, the distribution - is link equity concentrated in a few high-authority domains or spread across many? Third, the quality - are these editorial links, directory links, guest post links, PBN links? If I see a backlink profile that's heavily dependent on one type of link acquisition (especially guest posts or sponsored content), I flag it, because those link sources can disappear if the person managing them leaves.

Content freshness audit. Screaming Frog crawl of the entire site. Export the list of pages with their last-modified dates. Sort by date. How many pages have been updated in the last 6 months? The last 12 months? How many haven't been touched in over 2 years? Stale content isn't automatically a problem, but if the primary traffic drivers haven't been updated in 18+ months and the competitive landscape has changed (which it always has), the rankings those pages hold are at risk. They're coasting on historical authority, and historical authority depreciates.

Search Console access (if available). This is the gold standard, and you should push for it during due diligence. Most sellers are reluctant to give Search Console access because they don't understand what it reveals (which is, ironically, the whole point of asking for it). If you can get it, look at: actual clicks and impressions by query (far more accurate than third-party estimates), manual actions or security issues (rare but devastating), index coverage errors (are there thousands of pages Google is refusing to index?), and Core Web Vitals issues. If you can't get Search Console access, ask for screenshots of the Performance and Coverage reports. Even screenshots are better than nothing.

The competitive landscape query. For the target's top 10 non-branded keywords, manually search each one. Who else is ranking? How strong are they? Is the target ranking because their content is genuinely the best, or because the competition happens to be weak? If the competitive landscape is soft (low-authority competitors, thin content, few dedicated pages), the target's rankings are vulnerable to any well-funded competitor entering the space. If the competition is strong and the target is holding its own, the organic position is more defensible.

The 72-Hour Version

Brian Kowalski didn't have two weeks. He had until Thursday, maybe Friday. Here's what I told him to do, in order of priority, in the time he had.

First: pull the branded/non-branded split. Thirty minutes in Semrush. This alone tells you whether the organic number is real or inflated. If it's 70% branded, the organic traffic story in the investment thesis needs to be rewritten.

Second: pull the top 25 pages by organic traffic and calculate concentration. Another thirty minutes. If more than 50% of traffic is in the top 10 pages, that's a red flag that should be in the memo to the investment committee.

Third: ask the sell-side who's responsible for SEO and whether they're staying post-close. One phone call. If the answer is \"one person\" and \"we don't know,\" you have a bus factor problem that should be addressed in the deal terms (retention bonus, transition agreement, whatever it takes to keep that person for at least 12 months).

Fourth: check whether a site migration is in the 100-day plan. If it is, push it back. I don't care what the operations playbook says. Push it back to month 6 at the earliest. Give yourself time to understand the ecosystem before you start changing it.

That's two hours of work. Maybe three. It won't give you a complete picture. But it will give you enough to know whether the organic traffic number in the model is something you can rely on or something you should discount.

Brian did the work. He called me back Friday morning. The branded split was 64/36 in favor of branded. The top 5 pages drove 47% of organic traffic. The one person responsible for SEO was the founder, who was transitioning out in 90 days.

\"So the organic number in the model,\" he said.

\"Is about 40% of what you think it is,\" I said. \"And it's going to decline post-close unless you retain the founder for at least a year and don't touch the website for six months.\"

Silence on the line. The kind of silence that means someone is doing math and the math isn't coming out the way they need it to.

\"We're still closing,\" he said.

\"Okay,\" I said. \"Then build the decline into the model. Don't pretend the organic number is stable when it isn't. Discount it by 30% for the first 18 months and budget for recovery. At least that way the returns won't surprise you.\"

He thanked me. They closed. I don't know what they built into the model. I do know that six months later, Brian called me again. The organic traffic was down 35%. The founder had left at month 4. Nobody had run a migration, which was the one piece of advice they'd followed.

\"Could have been worse,\" he said.

He wasn't wrong. It could have been worse. It usually is.

What Due Diligence Actually Buys You

I want to be clear about what SEO due diligence can and can't do. It can't predict the future. It can't guarantee that organic traffic will remain stable. It can't account for algorithm changes that haven't happened yet, or competitive moves you can't foresee, or the thousand other variables that make organic search a probabilistic game rather than a deterministic one.

What it can do is tell you what you're buying. Not the number. The number is in the model already. What's behind the number. How fragile it is. How concentrated. How dependent on specific people, specific pages, specific technical configurations, specific competitive conditions. It can tell you where the risk is, so you can price it. It can tell you what not to change, so you don't destroy it. It can tell you who to retain, so the institutional knowledge survives the transition.

In fourteen PE engagements, the ones that did proper due diligence - real due diligence, not the SimilarWeb glance - were the ones that preserved their organic traffic post-acquisition. Not because the due diligence itself prevented decline, but because the understanding it produced informed better decisions. The firms that understood the ecosystem didn't try to optimize it with a playbook. They managed it. Carefully. With respect for the complexity of what they'd acquired.

The firms that skipped the due diligence, or crammed it into a phone call, or treated the organic traffic number as a fixed input rather than a variable output of a complex system - those firms got the ski-slope chart. Every time.

SEO due diligence is not expensive. A comprehensive engagement costs $15,000 to $30,000 and takes two to three weeks. In the context of a multi-million dollar acquisition, this is a rounding error. It's less than the legal review of the trademark portfolio. It's less than the environmental assessment on the office lease. It's less than the management team's dinner at the closing celebration.

And it's the difference between knowing what you bought and guessing.

Brian Kowalski figured this out the hard way. Most PE firms do. The organic traffic number is in the model, and the model is in the deck, and the deck is in front of the investment committee, and nobody in the room knows where the tires are. They're kicking the fenders. They're checking the paint. They're admiring the chrome. And the tires - the actual things holding the whole vehicle up, the specific pages and people and links and technical configurations that produce the number in the model - nobody's looked at those. Nobody even knows where to look.

Now you do.