SEO Due Diligence in M&A: The Two-Week Audit That Killed an $11M Acquisition

The Call That Started It

February 14th, 2026. A PE-backed acquirer brought me in nine days before LOI signing. Their target: a B2B SaaS company in the project management adjacency, asking $11.2M at 4.1x ARR. The investment thesis leaned heavily on organic search. The deck said 68% of new MRR came from inbound, and inbound was predominantly organic. They'd looked at Semrush screenshots. They'd reviewed a GA4 summary the founders had sent over. The financial model assumed organic traffic would hold post-acquisition and grow 18% year-over-year through 2028.

Nobody had opened Google Search Console.

I want to be precise about what I mean by "leaned heavily on organic search." The $11.2M valuation was partly a multiple on current ARR, but the growth premium baked in assumed that organic acquisition continued at its current clip. Strip that out, and the defensible multiple on a slower-growth asset dropped the valuation closer to $7.4M. The difference between those two numbers is essentially the question: is this organic traffic real, sustainable, and transferable?

Two weeks later, we recommended against closing. Here is how that happened.

What Standard DD Misses About Organic Traffic

Traditional M&A due diligence runs financial, legal, and operational tracks. In tech acquisitions there is usually a technical track covering infrastructure and code quality. Almost nobody runs a structured SEO track, because SEO lives in a weird no-man's-land: too technical for the finance people, too commercial for the engineers, and too opaque for founders who grew up in an era when "just publishing good content" actually worked.

The result is that acquirers get handed a Semrush or Ahrefs export, look at the domain rating, nod at the traffic trend line, and move on. That is not due diligence. That is confirmation bias with a tool subscription.

The deeper problem: organic traffic is not an asset in the accounting sense. You cannot depreciate it. It does not appear on a balance sheet. You cannot contractually transfer it. What you are actually buying is a probability distribution over future organic visibility, which is contingent on Google's continued willingness to send traffic to that domain, on the structural health of the site, and on whether whoever built the traffic used methods that will survive the next core update.

For this deal, none of those questions had been asked.

The MORTAR Framework

I have run SEO audits in acquisition contexts six times now. The first two I invented the process as I went. After the third one (where I missed something important, more on that below), I built a repeatable structure. I call it MORTAR, not because it's particularly clever but because it helps me remember the sequence under the time pressure of a real DD window.

• M - Migration risk (historical domain changes, past redirects, subdomain history)
• O - Organic revenue attribution (what portion of revenue actually traces to organic search)
• R - Ranking fragility (keyword concentration, single-page dependency, SERP feature exposure)
• T - Traffic trend integrity (seasonality-adjusted, GA4 vs. GSC reconciliation, bot filtering)
• A - Authority profile health (backlink quality, velocity anomalies, disavow history)
• R - Regulatory and content risk (YMYL exposure, AI Overview displacement, manual action history)

The framework is intentionally front-loaded toward discovery of problems rather than documentation of strengths. In an acquisition context, your job is not to write a marketing report about the target's SEO. Your job is to find the things that will blow up after close.

Week One: Signal vs. Noise in the Traffic Data

Day one. The target's founder gave us read access to GSC and GA4. I immediately noticed a discrepancy that the Semrush export had completely hidden: GA4 showed 41,000 monthly organic sessions. GSC showed 27,300 monthly clicks. That is a 33% gap.

A gap of 5-10% is normal. Noise, bots, dark traffic, referral misclassification. A 33% gap is a flag. Either GA4 is over-attributing to organic (common when UTM parameters are missing from paid campaigns, so paid traffic bleeds into organic), or there is significant bot traffic inflating session counts, or someone has been routing direct/referral traffic through organic as a vanity metric in reporting.

In this case it was a combination of the first two: their LinkedIn paid campaigns had zero UTM tagging, so all click-throughs were landing as organic/direct in GA4. Once we reclassified those, the real organic session count was closer to 31,000 monthly, which was still meaningful but already 24% lower than the headline number in the acquisition deck.

Pulling the Real GSC Numbers

The founder had given us GSC read access but was also very proud of showing us a screenshot of their impressions chart. I ignored the screenshot and pulled the data directly via the GSC API. Here is the query structure I used:

# GSC API export — 16 months of data, page-level, query-level
# Requires: google-auth, requests libraries

import json
import requests
from google.oauth2.credentials import Credentials
from google.auth.transport.requests import AuthorizedSession

SITE_URL = "https://www.target-domain.com/"  # anonymized
START_DATE = "2024-10-01"
END_DATE = "2026-02-14"
ROW_LIMIT = 25000

def fetch_gsc_data(session, dimension, start_date, end_date):
    payload = {
        "startDate": start_date,
        "endDate": end_date,
        "dimensions": [dimension, "date"],
        "rowLimit": ROW_LIMIT,
        "dataState": "final"
    }
    endpoint = f"https://searchconsole.googleapis.com/webmasters/v3/sites/{SITE_URL}/searchAnalytics/query"
    response = session.post(endpoint, json=payload)
    return response.json()

# Pull page-level data
page_data = fetch_gsc_data(session, "page", START_DATE, END_DATE)

# Pull query-level data
query_data = fetch_gsc_data(session, "query", START_DATE, END_DATE)

# Export to JSONL for downstream analysis
with open("gsc_pages.jsonl", "w") as f:
    for row in page_data.get("rows", []):
        f.write(json.dumps(row) + "\n")

with open("gsc_queries.jsonl", "w") as f:
    for row in query_data.get("rows", []):
        f.write(json.dumps(row) + "\n")

print(f"Pages exported: {len(page_data.get('rows', []))}")
print(f"Queries exported: {len(query_data.get('rows', []))}")

Pulling 16 months of data matters because you need enough history to separate seasonal patterns from structural decline. This target's traffic had a shallow dip in August 2025 and recovered. Looking at only the last 90 days, you'd call that a healthy site. Looking at the full 16 months, you could see that the October 2024 recovery never fully recaptured pre-August levels, and the slope from October onward was flatter than the founder described.

Then came the query concentration analysis. Of their 27,300 monthly GSC clicks, 9,840 (36%) came from exactly three branded queries: the company name, the company name plus "pricing," and the company name plus "reviews." Non-branded clicks: 17,460 per month. That is the number that matters for an acquisition, because branded traffic is not really an organic SEO asset. Branded traffic follows the brand. Non-branded traffic is the actual evidence of SEO capability.

Now, 17,460 non-branded monthly clicks is still not nothing. But look at the concentration within non-branded: the top 20 keywords drove 71% of non-branded clicks. The top keyword alone, a very specific head term in their category, drove 4,200 clicks per month. That single keyword accounted for 24% of all non-branded organic traffic.

One keyword. Twenty-four percent.

The Backlink Toxicity Audit

Day four. The authority profile review. The domain had a DR of 54 on Ahrefs, which looks respectable. What the DR number does not tell you is the composition of what built it.

# Backlink toxicity audit — Ahrefs API v3 + custom scoring
# Flags: link velocity spikes, low-DR clusters, TLD concentrations, anchor text over-optimization

import pandas as pd
import requests
import numpy as np
from datetime import datetime

AHREFS_TOKEN = "your_token_here"
TARGET_DOMAIN = "target-domain.com"

def fetch_backlinks(domain, token, limit=10000):
    url = "https://api.ahrefs.com/v3/site-explorer/backlinks"
    headers = {"Authorization": f"Bearer {token}"}
    params = {
        "target": domain,
        "limit": limit,
        "mode": "domain",
        "select": "url_from,domain_rating_source,anchor,date_first_seen,url_to,nofollow",
        "order_by": "date_first_seen:desc"
    }
    resp = requests.get(url, headers=headers, params=params)
    return pd.DataFrame(resp.json().get("backlinks", []))

df = fetch_backlinks(TARGET_DOMAIN, AHREFS_TOKEN)

# Velocity analysis: backlinks per 30-day window
df["date_first_seen"] = pd.to_datetime(df["date_first_seen"])
df["month"] = df["date_first_seen"].dt.to_period("M")
velocity = df.groupby("month").size().reset_index(name="new_links")

# Flag velocity spikes (>2 std deviations above rolling mean)
velocity["rolling_mean"] = velocity["new_links"].rolling(3).mean()
velocity["rolling_std"] = velocity["new_links"].rolling(3).std()
velocity["spike"] = velocity["new_links"] > (velocity["rolling_mean"] + 2 * velocity["rolling_std"])

# Anchor text concentration
anchor_counts = df["anchor"].str.lower().value_counts(normalize=True)
top_anchor_pct = anchor_counts.head(3).sum()

# DR distribution
dr_bins = pd.cut(df["domain_rating_source"], bins=[0, 10, 20, 40, 60, 100], labels=["0-10","10-20","20-40","40-60","60+"])
dr_dist = dr_bins.value_counts(normalize=True)

# TLD concentration
df["tld"] = df["url_from"].str.extract(r'\.([a-z]{2,})\/')
tld_dist = df["tld"].value_counts(normalize=True).head(10)

print("=== Velocity Spikes ===")
print(velocity[velocity["spike"]])
print("\n=== Top Anchor Text (%) ===")
print(anchor_counts.head(10))
print("\n=== DR Distribution ===")
print(dr_dist)
print("\n=== TLD Concentration ===")
print(tld_dist)

Running this against the target's 8,400 referring domains revealed several patterns that would not have been visible in a dashboard screenshot.

First: a velocity spike in March 2025. In a single 30-day window, the domain acquired 1,847 new referring domains. Before that month, their average new-link acquisition rate was 94 per month. After that month, it dropped back to 67. One month. Nineteen times the baseline. That is not organic growth. That is a link campaign.

Second: 34% of all referring domains had a DR of 0-10. Another 21% were DR 10-20. So 55% of the link profile was coming from very low-authority sites. That is not automatically disqualifying, but combined with the velocity spike and what came next, it was part of a pattern.

Third: the anchor text. The top three exact-match anchors accounted for 31% of all anchors. In a healthy natural link profile, your top three anchors are usually branded variations and generic terms like "here" or "this article." These were all exact-match commercial keywords. Someone had built these links deliberately, using commercial anchor text, to rank for commercial terms.

We dug into the March 2025 spike manually. Many of the linking domains were forum profiles, comment spam on low-traffic blogs, and a cluster of what appeared to be a private blog network sharing similar WordPress templates, similar hosting IP ranges, and similar article structures. None of these domains had any real traffic of their own per Ahrefs estimates.

The target had no disavow file. They had either not noticed, not cared, or not wanted to bring it up during DD.

Week Two: When the Numbers Stopped Adding Up

Day eight. We presented the preliminary findings to the acquiring firm. Their reaction: "Can't we just disavow the bad links after close?" That is the wrong question. The right question is: has Google already seen this?

A manual action would show in GSC. There was none. But that absence is not reassuring in the way acquirers want it to be. Manual actions are relatively rare. Algorithmic suppression is common. The March 2025 link spike coincided with a period when the target saw a meaningful ranking improvement for their primary commercial keyword. That improvement was now the source of 24% of their non-branded organic traffic.

If that improvement was driven by the link campaign rather than by genuine authority signals, then it exists in a fragile state. A core update, a link spam update, or an algorithmic reassessment could collapse it. The acquirer would be buying not a durable SEO asset but a position that was rented on borrowed time.

Days nine through eleven focused on content-layer risk. The target had 847 indexed pages. Of those, 203 pages had received fewer than 10 GSC impressions over 16 months. That is 24% of their index producing essentially no search visibility. Classic bloat from an AI content push in late 2024: you could see it in the URL patterns and in the publishing cadence in the Wayback Machine. They had gone from publishing roughly four articles per week to 22 per week for about three months, then back to five per week. Most of that burst content was thin.

Google's Helpful Content guidance creates a site-level quality consideration. A large proportion of unhelpful or low-engagement content on a domain can suppress the rankings of pages that are otherwise fine. The 203 dead pages were not isolated. They were a site-health liability.

Full DD Checklist: SEO Signals That Affect Valuation

This target scored red on five signals, yellow on four, and green on six. That 5-red profile alone does not necessarily kill a deal. Context matters. But five reds in an acquisition where organic traffic is the primary growth driver and the primary justification for the premium multiple? That changes the conversation entirely.

Calculating Organic Revenue at Risk

The acquiring firm needed a number, not just a list of risks. That meant quantifying what portion of current revenue was contingent on the organic positions that we considered fragile.

Here is the logic chain I used:

Total non-branded organic clicks per month: 17,460. Of those, 4,200 came from the single primary keyword we flagged as potentially manipulation-supported. Adjacent keywords correlated with that same ranking cluster contributed another 2,800 clicks. So 7,000 clicks per month, or 40% of non-branded organic traffic, were in what I called the "fragile cluster."

Conversion rate from organic landing pages in that cluster: 2.3% to free trial (from GA4 goal data). Trial-to-paid conversion: 14.7% (from the founder's CRM export, which we spot-checked). Average deal value: $187 MRR. So the math:

7,000 clicks × 2.3% = 161 trials/month. 161 × 14.7% = 23.7 new MRR customers/month from the fragile cluster. At $187 average MRR: $4,432 new MRR/month at risk. Annualized new ARR at risk: $53,184. But this is a SaaS business with churn. Factoring in their reported 4.2% monthly churn and the multi-year nature of the asset, we calculated a lifetime ARR impact of roughly $1.1M to $1.4M if the fragile cluster collapsed post-close.

That is not the whole story though. The fragile cluster was also serving brand awareness: some portion of users who found the company through those keywords and did not convert immediately were still entering a longer sales cycle. Killing that channel does not just remove direct conversions. It removes the top of a funnel that fed referral and branded search downstream. We applied a 1.3x multiplier for this indirect effect, raising the total organic revenue at risk to approximately $1.4M to $1.8M in present-value lifetime ARR.

Against an $11.2M acquisition price, that is a 12.5% to 16% risk to the thesis from this one factor alone. Combined with the other reds in the checklist.

Two Things the M&A Industry Gets Wrong About SEO

Here is where I might lose some people. These are positions I hold that are not popular in the deal community.

Contrarian take one: domain authority is a nearly useless valuation input. Every single acquisition deck that includes an SEO section leads with DR or DA. Buyers nod at it. It has face validity. High number good, low number bad. But what domain rating actually measures is the aggregate link profile, which is a trailing indicator, which can be manipulated, and which does not directly correspond to current or future traffic performance. I have audited sites with DR 70+ that were in structural traffic decline because their content was aging and their link profile was stale. I have seen DR 31 sites with tight, topically authoritative profiles that were outranking DR 55 competitors on every commercial keyword. Stop leading with DR in valuation discussions. It is a distraction from the questions that actually matter.

Contrarian take two: "organic moats" are almost always smaller than acquirers believe. The concept of an organic moat circulates in growth-oriented PE circles: the idea that a site with enough links and enough content history has built a durable competitive position that new entrants cannot replicate quickly. Sometimes true, but far more often overstated. The actual barriers to organic replication in most B2B SaaS niches are lower than they appear. A well-funded competitor with a strong product can build topical authority in a focused vertical in 18 to 24 months. The "moat" interpretation also ignores platform risk: if Google changes how it handles a particular query type, adds an AI Overview that captures intent before the user clicks, or demotes a content format, the moat drains overnight regardless of how old the domain is. For this target, AI Overviews were already appearing on 38% of their primary keyword SERPs as of February 2026. That is not a moat. That is a shrinking beach.

The Mistake I Made and Still Think About

On my third M&A SEO audit, back in Q3 2024, I missed a redirected domain history. The target had acquired a defunct competitor's domain two years earlier and 301-redirected it to build link equity fast. It worked. Their DR jumped 14 points in four months. I saw the DR jump in the historical data, flagged it as unusual, but did not drill far enough into why. I attributed it to a PR campaign that happened around the same time. I told the acquirer the profile was healthy with moderate caveats.

Eighteen months after that deal closed, the redirected domain was identified in a link audit as a problematic private blog network that the original owner had monetized as a link vendor. The redirect had passed equity from a manipulative source. Google's systems eventually caught up with it. The site took a meaningful hit in a spam update in early 2025. The acquirer's inbound growth stalled for two quarters while they cleaned up the mess.

I should have pulled WHOIS history on the referring domain clusters. I should have checked the Wayback Machine on the top referring domains. I do that on every audit now. It is in the MORTAR framework under Authority profile health. It wasn't before that mistake.

I disclosed this to the acquirer at the time and offered to redo the audit at no charge. They didn't take me up on it. The relationship survived. But I think about that one when I am tempted to call something good enough.

What Actually Happened

We delivered our findings on day fourteen. The recommendation was not "do not buy." It was: "do not buy at $11.2M with the current thesis. Renegotiate to $7.8M to $8.4M, including an earnout structure tied to non-branded organic traffic maintaining baseline over 18 months post-close. Require a $200K escrow for remediation risk. And plan for a 6-month SEO stabilization period before relying on organic as a growth input in the model."

The founder rejected the renegotiated price. The deal died. The acquirer went back to market and found a different asset in a similar category, which they closed at $9.1M with a healthier organic profile and a DR that, frankly, was lower but built on cleaner signals. That company grew non-branded organic traffic 31% in the 12 months post-close.

As for the original target: their primary keyword dropped from position 3 to position 11 in the June 2026 core update. I know because I still have a rank tracker running on them. The fragile cluster collapsed almost exactly as modeled. They are now raising a bridge round.

The acquiring firm sends me new targets now. Three in 2025. Two so far in 2026. They have started including an SEO DD line item in their initial deal budget, the same way they budget for a legal retainer and a financial audit. That is the outcome I am most glad about: the process being normalized rather than treated as optional enrichment.

SEO due diligence is not a nice-to-have in deals where organic traffic is a material input to valuation. It is a fiduciary obligation. The tools are accessible, the data is available with proper access agreements, and two weeks is enough time to find what matters. You just have to actually look.

For practitioners who want to build this into their own advisory practice, the SEO case study framework and the backlink profile audit methodology I use in client engagements both apply in DD contexts. The content pruning decision framework is also relevant for estimating remediation timelines on bloated indexes. If you are assessing a site where link manipulation is suspected, the disavow strategy guide provides context for estimating the remediation workload and timeline, which feeds directly into earnout structure and escrow sizing in deal terms. For a deeper look at how AI Overviews are changing keyword-level traffic expectations, see the AI Overviews CTR impact analysis. External reference: the Google Search Console API documentation is the authoritative source for building your own data exports.

FAQ

What does SEO due diligence involve in an M&A context?

SEO due diligence in M&A involves a structured audit of the target company's organic traffic quality, backlink profile integrity, ranking fragility, content health, and organic revenue attribution. The goal is to determine whether the organic traffic underpinning the acquisition thesis is real, sustainable, and transferable post-close. Key data sources include Google Search Console API exports, Ahrefs or Majestic backlink data, GA4 session attribution, and manual SERP sampling.

How long does an SEO due diligence audit take?

A thorough SEO due diligence audit typically takes 10 to 14 business days when the acquirer has negotiated data access. Compressing below 10 days significantly increases the risk of missing compounding issues like redirected domain history or slowly declining ranking clusters.

What is organic revenue at risk in an acquisition?

Organic revenue at risk quantifies the portion of current or projected ARR that is contingent on organic search positions considered fragile due to link manipulation, ranking concentration, AI Overview displacement, or content quality issues. It is calculated by isolating the traffic cluster at risk, applying observed conversion rates and deal values, and projecting lifetime ARR impact to size the downside scenario.

Can a disavow file fix link manipulation issues before or after closing?

A disavow file can reduce ongoing exposure to manipulative links, but it does not guarantee reversal of algorithmic suppression. Disavow processing by Google can take months. For this reason, in acquisition contexts where manipulation is identified, the preferred structure is an earnout tied to traffic baselines and an escrow reserve, rather than assuming a post-close disavow will fully restore positions.

What is the MORTAR framework for SEO due diligence?

MORTAR is a six-component framework: Migration risk, Organic revenue attribution, Ranking fragility, Traffic trend integrity, Authority profile health, and Regulatory and content risk. It is designed to prioritize discovery of downside risks over documentation of strengths, which is the correct orientation for an acquisition audit.