Acquisition-Era Link Audits: What to Check When You Buy a Site

A 7-check acquisition link audit for site buyers: PBN detection, redirect archaeology, spam-policy exposure, deal-stage scorecards and price-adjustment thresholds.

Here’s a number that should change how you read every site listing: Flippa’s own valuation methodology prices content sites at 25–40x monthly profit, with backlink quality listed as an explicit adjustment factor. Sellers know this. Which means by the time a site reaches a listing page, its link profile has usually been dressed for sale — the disavow file quietly updated, the link-buying invoices deleted from the P&L, the anchor text “diversified” over the preceding six months. The traffic chart you’re shown is real. The question an acquisition link audit answers is whether it’s durable.

The market context makes this the single highest-leverage piece of due diligence you can run. Flippa reported a 37% decline in content-site sales volume tied to Google’s algorithm updates — a wave of sellers exiting assets they believe are exposed — while at the same time 37% of 2025 buyers were repeat purchasers running systematic acquisition strategies, with institutional capital moving into the $500K–$5M segment. Translation: the buy side is increasingly professional, the sell side is increasingly motivated, and the gap between the two is exactly the kind of link liability this audit catches. Curated brokers filter some of it — Empire Flippers reportedly rejects up to 91% of submitted listings — but broker vetting is solvency-grade, not forensic-grade. Nobody at any marketplace is reading the target’s anchor text distribution for you.

And the downside is not hypothetical. Google’s spam policies since March 2024 explicitly target expired domain abuse, site reputation abuse and scaled content abuse — three practices that are disproportionately concentrated in sites built to be sold — and enforcement has only tightened since: the March 2026 spam update rolled out in under 20 hours, the fastest confirmed rollout on Google’s status dashboard, sharpening detection of exactly these patterns. Buy a site carrying those liabilities and you inherit the penalty risk at the closing table. This article gives you the complete audit to run before you wire anything. If you’re newer to reading link profiles in general, skim our primer on what backlinks are and why they carry value first — everything below assumes that foundation.

Why the Link Audit Decides the Deal Economics

Three numbers frame the stakes. First, the multiple: at Flippa’s 25–40x monthly profit benchmark for content sites, a site earning £4,000/month lists somewhere around £100,000–£160,000. If a link liability threatens even a quarter of that profit, you are mispricing the deal by £25,000–£40,000. Second, the baseline attrition: UK due-diligence practitioners report organic traffic drops of 10–30% after most acquisitions even in clean deals — migration friction, content cadence breaks, seller relationships lapsing. Your model needs headroom for that before any link risk. Third, the audit cost: a thorough professional pre-acquisition audit takes 2–3 days and costs £500–£2,000 — a rounding error against the purchase price, and the DIY version below costs you a weekend and a tool subscription.

Let’s make that concrete with a worked example you can adapt. Target site: £3,500/month profit, asking £112,000 (32x). Your audit attributes £1,100/month of that profit to pages whose rankings depend on links failing Checks 3 and 4 — rented placements plus one unrelated redirected domain. Clean-subset profit: £2,400/month. At the same 32x multiple, the defensible price is £76,800, and the gap of £35,200 is your opening reprice. Add the Check 6 finding — say the audit shows the profile needs roughly 10 replacement referring domains a quarter to hold position, which you cost at £400–£700 each in internal effort or agency fees — and a further £16,000–£28,000 of annualised maintenance enters the model that the listing’s profit figure never mentioned. Two spreadsheet rows, and a £112,000 deal is revealed as a £75,000 deal with a £20,000-a-year tail. That is what an acquisition link audit is for.

One more framing point before the checklist. A link audit at acquisition is asking a fundamentally different question than a link audit on a site you already own. On your own site, you ask “what should I fix?” On a target, you ask “what was manufactured, what will decay, and what could detonate?” — manufactured authority that Google may re-evaluate, links that will quietly expire when the seller stops paying, and policy violations that turn into penalties under your ownership. Every check below maps to one of those three risk classes.

The 7-Check Acquisition Link Audit

Here’s the full framework up front — your deliverable. Run the checks in order (they’re sequenced so cheap checks can kill a bad deal before you spend hours on expensive ones), score each pass/caution/fail, and apply the price logic in the scorecard table. You need Ahrefs or Semrush, the Wayback Machine, and — for any deal you’re serious about — seller-granted read access to Google Search Console. A seller who refuses GSC access has answered your most important question already. Our breakdown of the best link building tools covers which subscription tiers include the historical index data you’ll need; for this job, historical depth matters more than any other feature.

Scoring rule of thumb: seven passes means pay the asking multiple with confidence. One or two cautions means proceed, but cost the remediation explicitly and negotiate it off the price. Any single fail on checks 3, 4, 5 or 7 — the detonation class — means walk away or reprice to distressed-asset levels, because you’d be buying a recovery project, not a business. Now let’s run each check properly.

Check 1: Link Inventory and Velocity History

Tool steps: drop the domain into Ahrefs Site Explorer → Referring domains → set the graph to “All time”. You’re reading the shape, not the totals. Then open the “New” and “Lost” referring domains report month by month for the past 24 months. In Semrush, the equivalent lives in Backlink Analytics → Referring Domains with the historical trend toggled on.

Three shapes should stop you cold:

• Step-function spikes. Thirty referring domains a month for two years, then 200 in one quarter, then back to thirty. Organic earned profiles grow lumpily but not vertically; vertical means a campaign was purchased. Note the spike dates — you’ll cross-reference them against traffic in Check 5.
• The pre-listing grooming pattern. A sustained rise in new referring domains starting 6–9 months before the listing date, often paired with a simultaneous rise in lost domains (old paid placements being allowed to lapse while fresh ones are added). This is a profile being dressed for sale. It isn’t automatically disqualifying, but every link in that window needs the Check 3 treatment.
• Net decay. Lost referring domains outpacing new ones for 6+ consecutive months means the profile is shrinking under the current owner — and link decay rarely slows down when the person who built the relationships leaves. Price the rebuild: if the site needs 10 quality links a quarter just to stand still, that’s a recurring cost line the listing’s profit figure conveniently omits.

Pass threshold: smooth, explainable growth with no unexplained quarter where new referring domains exceeded ~3x the trailing average. Ask the seller to account for any spike in writing — a genuine digital PR campaign or viral post is verifiable in minutes (the linking pages will be real articles on real news domains); a mumbled answer means Check 3 just became the whole audit.

Check 2: Anchor Text Distribution

Tool steps: Site Explorer → Anchors report, sorted by referring domains. Export it. Bucket every anchor into: branded (the site name and URL variants), natural/generic (“this guide”, “according to”, naked URLs), topical-partial (keyword appears within a longer phrase), and exact-match commercial (“best protein powder uk”, “casino bonus”).

Earned profiles are boring: branded and generic anchors dominate because real editors link with the site’s name or a lazy “here”. Manufactured profiles are legible in one sort: exact-match commercial anchors clustered on the site’s money pages. As a working threshold, exact-match commercial anchors above roughly 10% of referring domains — or any meaningful exact-match percentage pointing at affiliate money pages specifically — indicates the previous owner was buying anchors, with everything that implies for Check 3 and for how Google’s link spam systems will eventually treat the profile.

One acquisition-specific wrinkle: check anchor distribution per target page, not just sitewide. Sellers sometimes run clean sitewide numbers while three revenue-critical pages carry surgically optimised anchors — and those three pages are the ones generating the profit you’re paying 30x for. In Ahrefs, open the top money pages individually in Site Explorer and read their anchor clouds one by one. Ten minutes, and it’s the check most buyers skip.

Check 3: Paid and PBN Footprint Scan

This is the forensic core of the audit. Rented authority fails in two ways after a sale: it expires (paid placements lapse when invoices stop) or it detonates (Google’s systems catch the network and discount or penalise everything attached to it). Either way, you paid a profit multiple on traffic the links were propping up.

Work through the referring domains export with these filters:

1. The metrics-mismatch filter. Sort referring domains by DR/Authority Score descending, then scan each high-DR domain’s own organic traffic in a second tab. A DR 70 domain with near-zero organic traffic is the classic PBN signature: authority inflated by links, validated by no audience. A handful is noise; a cluster is a network.
2. The template-and-neighbourhood filter. Open ten suspicious linking pages in the browser. PBN tells: identical WordPress themes across “different” sites, no About page or a fictional author, posts on wildly unrelated topics (crypto, CBD, casino, plumbing) sharing one blog, and outbound links to obvious paying customers in every post. Check hosting too — a free reverse-IP lookup showing many linking domains on one shared IP block is corroborating, not conclusive.
3. The guest-post-marketplace filter. Search a distinctive sentence from a few linking articles in quotes. Syndicated placement content appears on multiple low-grade blogs verbatim. Separately, recognise the paid-placement aesthetic: generic 600-word posts titled “5 Tips For…” with exactly one dofollow link mid-paragraph to the target’s money page. The line between legitimate editorial contributions and bought placements is one we draw precisely in our guide to guest posting for links — at audit time, assume anything that pattern-matches the paid side will eventually be worth nothing.
4. The invoice question. Ask the seller directly, in writing: “Which links were paid for, via which vendors, and what is the monthly/annual renewal cost?” Then ask for the disavow file if one exists. Sellers lie by omission far more readily than in writing — and a written misrepresentation here feeds straight into the warranty clause we cover in the deal-mechanics section.

Threshold: if more than ~15–20% of the profile’s referring domains fail these filters, the site’s authority is substantially rented. Model the traffic without it. Usually the deal dies here — which is the audit working as intended.

Check 4: Redirect Archaeology

Some of the most dangerous “backlinks” in a target’s profile aren’t links at all — they’re entire expired domains 301-redirected into the site to pipe their authority across. This was a staple of site-flipper playbooks for a decade, and it is now squarely inside Google’s expired domain abuse policy, with 2026 enforcement explicitly tightening: redirects from expired domains are now only defensible where there is genuine topical alignment between source and destination — redirecting an unrelated domain purely to pass authority is precisely the targeted behaviour.

Tool steps: in the Ahrefs referring domains report, look for domains contributing implausibly large referring-page counts relative to a single linking root — then check whether the “linking” domain actually resolves, or 301s straight into the target. Ahrefs’ “Best by links” on the target with 301 filters, and Semrush’s Indexed Pages report, both surface inherited link equity. For every redirecting domain found: run it through the Wayback Machine. What was it before? A defunct competitor in the same niche redirected after a genuine asset purchase is defensible. A Polish dental clinic redirected into an English gardening blog is a liability with a countdown timer.

Deal logic: inherited redirects are invisible in the P&L but they are load-bearing for rankings. If a meaningful share of the site’s strongest “backlinks” arrive via topically unrelated redirects, you must model the traffic as if those redirects were discounted to zero — because the policy direction says they eventually will be. Also confirm who owns the redirecting domains and who pays their renewals. If they aren’t included in the asset sale, the seller can let them lapse — or point them at their next project — the month after completion.

Check 5: Penalty and Policy Exposure

Tool steps: this check requires seller cooperation, and that’s deliberate. Request read-only GSC access (Settings → Users and permissions takes the seller two minutes). Inside: Security & Manual Actions → Manual actions for the obvious red card, then Performance → compare the site’s traffic timeline against Google’s published update history. Overlay the dates of the March 2024 spam policy launch, the August 2025 spam update and the March 2026 spam update on the traffic chart. A clean manual-actions tab does not clear the site: algorithmic devaluations never appear there. What you’re reading for is step-down losses coinciding with spam updates — the signature of a profile Google has already partially discounted.

Three patterns and what they mean for the deal:

• Active manual action: walk away unless you are explicitly in the distressed-asset business. Recovery timelines run months and reconsideration is not guaranteed.
• Step-down on a spam update date, partial recovery since: the site has been algorithmically re-rated once and the remaining profile carries the same characteristics. Price as if another step down is coming, because the enforcement trend says it is.
• Traffic stable through every update since early 2024: genuinely meaningful positive signal — the strongest single data point in the whole audit, because the profile has been live-tested against the exact policies you’re worried about.

While you’re in GSC, pull the Links report and diff it against the Ahrefs export. Material discrepancies — domains Google sees that the crawler doesn’t, or vice versa — usually point at deindexed PBN domains (Google stopped counting them; Ahrefs still finds them). That’s Check 3 evidence arriving through the side door.

Check 6: Concentration and Decay Risk

Tool steps: from the referring domains export, calculate what share of total referring domains — and, more importantly, what share of links to the top five traffic-driving pages — comes from the top 10 linking domains. Then check the relationship behind each: is the link editorial (a citation in an article), structural (a partner page, a directory, a widget), or personal (the founder’s mate runs the linking site)?

Concentration is a transferability problem. An owner-operated site’s best links often exist because of the owner — their commentary relationships, their conference talks, their community standing. Those links don’t transfer with the Stripe account. If the top 10 domains supply more than ~40% of meaningful link equity, and the relationships behind them are personal, your post-acquisition plan needs a budgeted earned-link programme from day one, not as a growth lever but as maintenance. The channel options and costs are exactly the ones in our hub on proven link building strategies — for deal-modelling purposes, assume a competent earned programme replaces 8–12 quality referring domains a quarter and cost it accordingly against the listing’s profit figure.

Check 7: The Wayback Identity Check

Tool steps: load the domain in the Wayback Machine and step through snapshots at yearly intervals back to first capture. You’re answering one question: has this domain always been this site? Then cross-check domain age and registration history via a Whois history lookup.

What you’re screening for is the resurrection pattern: the domain was something else — a charity, a local business, a foreign-language site — went dark, and was re-launched as the current content site to harvest its legacy backlinks. That is the textbook definition of the behaviour inside Google’s expired-domain policy, and it has a second-order problem the seller won’t mention: the legacy links pointing at the old identity are topically irrelevant to the current site, which means the “DR 45” you’re paying for is partly built on equity that current enforcement treats as discountable or abusive. A domain that has been the same site, on the same topic, under verifiable continuous ownership for its whole life passes in five minutes. Anything else, extend the audit.

A Necessary Caveat: “Toxicity Scores” Are Not an Audit

Every major tool now ships an automated link-risk metric — Semrush’s Toxicity Score, various “spam scores” elsewhere — and every acquisition season produces buyers who run one report, see “12% toxic”, and call the diligence done. Resist this. Automated toxicity metrics are pattern-matchers tuned for sites you already own, optimised to avoid false negatives, and they fail in both directions on acquisition targets: they flag harmless directory and forum links as toxic (inflating remediation estimates the seller will rightly contest), and they routinely pass well-built PBNs whose entire purpose is to look like legitimate sites to exactly these pattern-matchers. A network good enough to fool Google for three years is certainly good enough to fool a third-party toxicity classifier.

Use the scores the way the seven checks use every other metric: as a sorting mechanism that tells you where to point human attention, never as a verdict. The high-toxicity bucket is a reading list, not a disavow list. And in negotiation, never lead with a toxicity percentage — sellers have learned to rebut the number with the tools’ own documentation. Lead with the specific evidence the checks produce: named domains, observed footprints, written non-disclosures. Specifics survive contact with a broker; percentages don’t.

Related: if you find genuinely hostile links — spam blasts the seller claims are a competitor attack — treat the claim as plausible but immaterial. Google has stated for years that it’s good at ignoring such links, and your concern as a buyer isn’t whether the junk was bought by the seller or fired at them; it’s whether the rankings you’re paying for depend on anything in the junk pile. They almost never do. The links that should worry you are the ones that look good and were bought — not the ones that look bad and weren’t.

What the Data Shows vs What Buyers Believe

The belief: “DR 60 is DR 60 — authority is authority.” What the data shows: domain-level scores are third-party estimates that count links Google may have already discounted. The GSC-vs-crawler diff in Check 5 routinely reveals profiles where a third of the “authority” is invisible to Google. Buy on link provenance, never on a single blended score — Flippa’s own methodology treats backlink quality, not quantity, as the valuation adjustment factor.

The belief: “if the spam links are old and the site still ranks, Google has already forgiven them.” What the data shows: enforcement is retroactive and accelerating — the 2026 update sharpened detection of practices codified in March 2024 rather than adding new categories, meaning sites that survived earlier passes on borderline profiles saw their margin shrink, not their slate wiped. “Still ranking” means “not yet re-rated”, and you’d be buying the re-rating risk at full multiple.

The belief: “I’ll just disavow the bad links after completion and start clean.” What the data shows: disavowal removes (claimed) negative weight; it does not restore the positive weight the bad links were contributing. If rented links are propping up the rankings that generate the profit you paid 30x for, disavowing them post-completion crystallises the loss — you’ve paid for traffic and then voluntarily switched off its supports. The honest accounting happens before the offer: model the site’s traffic on its clean link subset only, and price on that. For benchmark context on what clean profiles in your target’s niche actually look like, our link building statistics hub collates the published distribution data.

Turning Audit Findings Into Deal Terms

An audit that ends in a slide deck is a wasted weekend. Each finding should land in one of four contractual places — discuss the specifics with your solicitor, as asset purchase terms vary, but these are the standard levers:

1. Price adjustment. The bluntest tool. Traffic attributable to at-risk links gets multiplied by the deal multiple and deducted. Showing the seller a spreadsheet — these 40 referring domains fail the PBN filters, they support pages generating £900/month, at your 32x multiple that’s £28,800 off — converts an argument about SEO opinions into an argument about arithmetic, which buyers usually win.
2. Representations and warranties. Have the seller warrant, in the purchase agreement, that all paid link arrangements have been disclosed, that no manual action has been received, and that no domain redirects material to the site’s rankings are excluded from the sale. The written answers you collected in Check 3 become the evidentiary trail.
3. Escrow and holdbacks. For mid-five-figures and up, hold back 10–20% of the price for 6–12 months against rankings collapse attributable to undisclosed link practices. Sellers with clean profiles accept this readily; the negotiating reaction to a holdback request is itself diagnostic.
4. Asset-list completeness. Every redirecting domain from Check 4, every Tier-2 property, every web property the seller controls that links to the target — listed in the asset schedule and transferred, or explicitly priced as absent. The most expensive post-completion surprise in content-site M&A is link infrastructure the buyer never knew existed until it was pointed somewhere else.

The First 90 Days: Protecting What You Just Bought

Completion day, your Monday-morning deliverable becomes operational. The 90-day link defence plan, in sequence:

• Week 1: take ownership of GSC, re-verify, export everything (the historical data access can lapse with account changes). Re-run Checks 1 and 5 from your own seat. Renew — under your control — any legitimate structural links the audit flagged as renewal-dependent.
• Weeks 2–4: contact the top 20 linking domains’ editors where a human relationship existed, introduce yourself, and confirm the links’ context still stands. This is unglamorous and it is the highest-ROI hour-per-link activity available in month one — links decay fastest at ownership handover, exactly when nobody is watching.
• Months 2–3: stand up the replacement earned-link programme costed in Check 6 — commentary placements, one data asset, steady editorial outreach — so the profile is net-growing again before the seller’s residual placements begin lapsing. Set a monthly referring-domains alert with a tripwire at the Check 1 decay threshold.

Flip the Table: If You’re the Seller, Audit Yourself First

Half the readers of this site own content businesses they will one day exit, so let’s run the logic in reverse. Everything above is a checklist your buyer will eventually run against you — and in a market where institutional and repeat buyers now dominate the serious end of the marketplace, “eventually” means “at the first quality-of-earnings conversation”. The sale-prep implications, in priority order:

• Start the clean-up 18–24 months out, not six. The pre-listing grooming pattern in Check 1 is visible precisely because sellers start too late and move too fast. A profile that has been growing on earned channels for two years reads as a trend; the same links acquired in seven months read as dressing. The earned channels that produce diligence-proof growth are the standard set — data assets, expert commentary, editorial outreach — all covered in our hub on proven link building strategies.
• Retire paid placements early and let the graph recover. Lapsed paid links show up as a lost-domains bump; give it a year to flatten before listing. Selling with active paid placements means either disclosing a renewal liability or warranting a falsehood — both are expensive.
• Document provenance as you go. A spreadsheet of every significant link — how it was earned, the editor relationship, the campaign behind it — is the single most underrated sale asset a content business can hold. It converts your strongest links from “unverifiable claims” into “transferable assets with receipts”, and buyers pay for what they can verify.
• Include link infrastructure in the data room. Redirecting domains, disavow history, GSC access from day one of diligence. Volunteering Check 4 and Check 5 material before it’s requested doesn’t weaken your position; it removes the discount a buyer applies for uncertainty, which is usually larger than the discount for any individual flaw.

How This Plays Out: An Anonymised Composite

A composite drawn from patterns we’ve seen repeatedly, anonymised rather than named. A UK buyer agreed heads of terms on a home-improvement content site at a low-six-figure price — roughly 31x monthly profit, in line with the marketplace benchmarks. The listing showed DR 52, 1,400 referring domains, traffic gently rising. Check 1 found the grooming pattern: new referring domains running at 4x the historical rate for the seven months before listing. Check 3 traced the surge to two guest-post marketplaces — generic posts, single mid-paragraph dofollow anchors, money-page targets. Check 4 found three redirected domains piping legacy equity from an expired Australian tradesman directory. None of it was disclosed.

The buyer didn’t walk. They re-modelled traffic on the clean subset — the site’s pre-grooming baseline — which supported roughly 60% of the listed profit, and re-offered at that level with a 15% twelve-month holdback and a warranty covering undisclosed paid links. The seller, mid-exit and facing a thinning buyer pool, accepted within a fortnight. Eight months later a spam update clipped exactly the pages the rented links had supported; traffic landed within a few points of the buyer’s clean-subset model, and the holdback covered the gap. The audit didn’t kill the deal — it repriced the risk to the party who created it. That is the entire job description.

Frequently Asked Questions

How long does an acquisition link audit take?

Budget 48 hours of focused work for the DIY version of the 7 checks on a typical content site, assuming you have Ahrefs or Semrush and seller-granted GSC access. Professional equivalents run 2–3 days at £500–£2,000 and are worth commissioning on any deal above roughly £25,000.

What’s the biggest red flag in a target site’s backlink profile?

A cluster of high-DR, zero-traffic referring domains — the PBN signature — pointing at the site’s money pages with commercial anchors. It combines manufactured authority, policy exposure and revenue concentration in a single pattern, and it fails three of the seven checks at once.

Should I ask the seller for their disavow file?

Always, and in writing. The file’s existence tells you the seller knew the profile had problems; its contents tell you which vendors they used; and a refusal to share it tells you the negotiation hasn’t been honest. Pair the request with a written question listing all paid link arrangements — the answers become warranty material in the purchase agreement.

Are 301 redirects from other domains into the site always bad?

No — a redirect from a genuinely related site the seller previously merged in is defensible and common. The 2026 standard is topical alignment: redirects from unrelated expired domains used primarily to pass authority sit squarely inside Google’s expired domain abuse enforcement. Audit every redirecting domain’s history individually, and make sure defensible ones are included in the asset sale.

Can a site with some bad links still be a good purchase?

Yes — almost every site that has existed for years carries some junk, and isolated low-quality links are normal background noise. The audit distinguishes noise from structure: bad links the site’s rankings don’t depend on are a footnote; bad links propping up the pages that generate the profit you’re paying a multiple on are the deal. Model traffic on the clean subset, and let that number set your price.

Does domain age make a link profile safer?

Only if the domain has been the same site for its whole life. An aged domain with a swapped identity is riskier than a young clean one, because its legacy links point at an entity that no longer exists — exactly the pattern current spam enforcement targets. Check 7 settles this in minutes via the Wayback Machine.

The Bottom Line

Marketplaces price content sites on profit multiples; Google prices them on link provenance. The gap between those two valuations is where buyers get hurt — and where disciplined ones make their returns. Run the seven checks before the offer, convert every finding into a price adjustment, warranty or holdback, and treat any seller resistance to GSC access or written link disclosures as the finding it is. The audit costs a weekend. Skipping it costs a multiple of whatever the seller was hiding.