Buying a business? Check its website, domain and accounts first

Short answer: Before you buy a small business, find out who actually controls its domain, website, email, analytics, ads, social and app accounts, and verify its traffic claims yourself with read-only access rather than screenshots. Then agree, in writing, a transfer-day plan that moves every account into your name in the right order. The usual trouble spots are accounts registered to a former employee, an agency or the seller's personal email.

When you buy a café, a cleaning company or an online store, the website and its accounts are often a big part of what you are paying for: the leads, the bookings, the reviews, the customer list. They are also the assets most likely to be tangled up in someone's personal Gmail. This checklist covers the practical checks. Your attorney handles the purchase agreement; one line in it should list every account below and who transfers it.

Due-diligence checklist by asset

1. Domain name

Who is the registrar? If the seller does not know, ICANN's registrant FAQ points to its lookup tool, where the "Registrar" field shows who holds the registration.
Who is the registrant? The business, the owner personally, or the web designer who set it up years ago. Ask the seller to log in while you watch and show the registrant details and the account email.
Expiry date and auto-renewal. A domain due to expire during the sale is an avoidable risk.
Transfer restrictions. ICANN's FAQ explains that a registrar may refuse a transfer to another registrar within 60 days of initial registration, and that changing the registrant name, organization or email can trigger a 60-day lock on moving to a different registrar, which some registrars let you opt out of. ICANN has been updating its transfer rules, so check the current pages before planning dates.
Other domains the business owns: old brand names, misspellings, country versions. List them all.

2. DNS and email

Where is DNS managed: the registrar, the host, or a separate service?
What runs on the domain: website, email, booking system subdomains, email marketing verification records.
Who provides business email, and whose account is the admin? Moving email is usually the most disruptive step, so it needs its own plan.

3. Website and hosting

Platform (WordPress, Shopify, Squarespace, a custom build) and who holds the admin login.
Hosting account owner and billing card. A site hosted on an agency's server needs an agreed move or a written arrangement.
Backups: when was the last full backup, and can you restore it?
Plugins, themes or apps with paid licenses tied to someone else's account.
For a custom build, access to the source code repository.

4. Traffic and revenue claims

Do not accept screenshots or PDF exports alone. Ask for read-only access so you can look yourself.

Google Search Console: the seller can add you as a user. Google's permissions help page describes owners, full users (view rights to all data and some actions) and restricted users (simple view rights on most data). A restricted user is enough for diligence. Look at clicks and queries as far back as the report allows, and check for sudden drops.
Google Analytics 4: the seller can add you with the Viewer role. Google's user management article explains that access can be given at account or property level, and that adding someone at account level gives them access to every property in it, so ask for property-level access to the relevant site.
Ecommerce or booking platform reports: orders, refunds and repeat customers straight from the platform, compared with bank deposits your accountant reviews.
Ad accounts: if traffic depends on paid ads, view spend and results. A business that only sells while ads run is a different asset from one with steady organic traffic.

Check the traffic sources too. A spike from one referral site, or traffic mostly from countries the business does not serve, deserves questions.

5. Customer data and email lists

Which email marketing platform, how many contacts, and how they were collected.
Whether the list can be moved to your account under the platform's rules.
Where customer records live: CRM, booking system, spreadsheets. Check the rules where you operate on transferring customer data before moving it.

6. Reviews and listings

Google Business Profile: who is the primary owner? You will need the current owner to add you before closing, so confirm they can log in.
Yelp, Tripadvisor, industry directories: list the logins.
Social media accounts: which are business pages, and which are someone's personal profile acting as one.

7. Apps

If the business has a mobile app, whose Apple and Google developer accounts publish it? Moving an app between developer accounts is possible through each store's transfer process, but it takes preparation and both parties.
Push notification keys, backend hosting and any app-related subscriptions.

8. Subscriptions and tools

List every recurring charge connected to the website and operations: booking software, payment processor, phone system, chatbot, scheduling, design tools. Note which can be transferred and which must be canceled and re-created.

The transfer-day plan

Agree an order of operations so nothing goes dark. A sensible sequence:

Week before: you create your own accounts where a transfer is not possible (email marketing, some SaaS tools). Back up the website, export customer and order data, and confirm all passwords in a shared password manager vault the seller hands over.
Day one: move control, not infrastructure. You are added as owner or admin on the domain registrar, hosting, Search Console, GA4, Business Profile, social pages and ad accounts. Change passwords and turn on two-factor authentication with your own devices.
Day one, continued: update billing cards on every service, so the seller can cancel theirs without services lapsing.
First weeks: remove the seller's and former staff's access account by account, once the handover period agreed in the sale ends.
When stable: move domain, hosting or email provider if you want to, one at a time, never on the same day as the ownership change.

Keep a simple spreadsheet: asset, platform, current owner, new owner, date moved, confirmed by.

FAQ

What if the domain is registered to the seller personally?

That is common. It can be moved to your business, but plan for the registrar's process, and avoid any registrar transfer in the days around closing.

Is a traffic screenshot ever enough?

It is a starting point. Read-only access to the live tools is easy for the seller to grant and shows far more.

Should I keep the seller's web developer?

Often yes, at least for a handover period, since they know how things were built. Make sure the accounts are in your name regardless.

How long does the digital handover take?

Control can move in a day if logins are ready. Moving providers is better done over weeks.

If you are buying a business and want someone to review its website and accounts before closing, tell us what is included.