Website due diligence: a UK checklist before you buy

A website sale looks like one transaction. In practice it is a bundle: a domain name held through a registrar, words and pictures owned by whoever created them, code and plugins under assorted licences, analytics and advertising accounts in someone's name, a customer list governed by data protection law, and income that depends on third parties. Each of those reaches you by a different route, and some don't reach you at all unless someone signs something.

This checklist is for UK buyers of small and medium websites, and it is about the business you are buying: who really holds the domain and how it moves to you, who owns the content, whether the traffic and income are real, what UK law says about customer data, and the order of the handover. Checking the name itself (its registration record, past uses, trade mark exposure and the .uk dispute test) is a separate job, covered in our guide to researching a .uk domain before you buy. It is general and educational, not legal, tax or financial advice. For anything beyond a modest purchase, a solicitor and an accountant who have handled online business sales are worth their fees. We'll say that once, here, rather than in every section.

Start here, because everything else depends on it. A seller who doesn't control the domain can't sell you the website, however good the rest looks.

The public record won't settle the question. Since Nominet's data protection changes of May 2018, the .uk WHOIS has not shown the registrant's name or address without their consent, and the WHOIS itself closes on 9 February 2027 in favour of RDAP. So ask for proof directly.

• Watch the seller log in to the registrar account on a live screen share and open the domain. Note the registrant name shown there and the expiry date.
• Check the registrant is the seller. If the seller is a company, the registrant should be that company, and its details should match its Companies House record. A name registered to a web agency, a former employee or a sole trader who isn't party to the sale is a problem to solve before completion, not after.
• Ask for a change you choose, such as a DNS TXT record containing a random string you supply. It proves the seller controls the DNS today. It doesn't prove they are the registrant: an agency or host can control DNS without holding the name.
• Check the expiry date. Under Nominet's current process, a .uk name that isn't renewed stops resolving 30 days after expiry, can still be renewed until 90 days after expiry, and drops 95 days after it. That process changes when .uk moves to a standardised registry on 9 February 2027. Either way, if the name expires within the next few months, agree in writing who renews it and when.

Moving the name to you is a registrar matter. Nominet's own guidance to registrars talks about "domain names on your tag": a .uk name sits with a particular registrar, and changing the registrant, or moving the name to another registrar, goes through registrars rather than directly between buyer and seller. The steps differ between registrars, so ask the seller's registrar, and yours if you'll move the name, how they handle each before you agree a timetable. Tie the final payment to the registrant of record changing to you.

Finally, consider whether anyone else could claim the name. Disputes over .uk names go through Nominet's Dispute Resolution Service, administered by WIPO for disputes filed from 7 July 2026, and its test covers how a name has been used as well as how it was registered, so the way the seller ran the site can matter. The research guide sets out the test and the trade mark searches that go with it.

Buying the domain doesn't buy the words on the site. In the UK, "You get copyright protection automatically - you do not have to apply or pay a fee", and GOV.UK names web content and photography among the works covered. The author is the first owner of the copyright, except that work made by an employee in the course of employment belongs to the employer, "subject to any agreement to the contrary" (Copyright, Designs and Patents Act 1988, section 11).

The trap is freelance work. GOV.UK's guidance is that "If you're self-employed, you usually own the intellectual property even if your work was commissioned by someone else - unless your contract with them gives them the rights." Small-business sites are often written, photographed and designed by freelancers. Unless the seller holds written assignments from them, the seller may own less of the site than they think, and can only sell you what they own.

Ask for:

• a list of who created the text, images, logo, design and any custom code;
• signed assignments, or contracts that assign the rights, from each freelancer and agency;
• the licences for stock images, fonts and themes, and whether they allow transfer to a new owner;
• a clause in the sale agreement assigning to you everything the seller does own.

If the site's value lies in a directory, listings or a product catalogue, database right may also apply. It protects a database's contents where there has been "a substantial investment in obtaining, verifying or presenting the data", and like copyright it is automatic. Make sure the agreement covers it.

Here the question is what the business owns, not whether the name is safe. Search the IPO's trade mark register on GOV.UK for the site's name, its brand and its main product names. If the seller owns a registered mark, it should be assigned to you as part of the deal; if someone else owns a matching one, find out why before going further.

Then check Companies House, which shows free of charge a company's registered address, date of incorporation, current and resigned officers, filed documents, mortgage charges, previous company names and insolvency information. Check the seller's company, and any company whose name matches the site's brand. A brand company that has been dissolved, is in insolvency, or is controlled by someone outside the sale changes what you are actually buying.

A seller's account of a site's history is a claim. Public web archives such as the Internet Archive's Wayback Machine let you test it. Look at captures across the years the seller says the site has been running, and ask:

• Was it the same business, on the same topic, throughout? A site that was a parked page or something unrelated until recently is not an established site, whatever the domain's registration date says.
• Did the name lapse at some point? A registrar's holding page, or a gap followed by a completely different site, suggests it may have changed hands.
• Do the old pages show claims, products, prices or people that the current site no longer mentions, and could any of them come back to bite a new owner?

Treat the archive as evidence, not a complete record. The Internet Archive does not capture password-protected pages or pages reached only through forms, and robots rules or an owner's request can keep a site out, so a missing year is not proof that the site didn't exist. Reading a domain's archive history in detail, including redirects and the warning signs in a name's last chapter, is covered in the research guide.

A screenshot of an analytics dashboard is easy to produce, easy to edit, and shows only what the seller chose to capture. Ask for read-only access to the site's analytics and Google Search Console or, failing that, a live screen share where you decide what to open. Then look at:

• at least 12 months of data, so that seasonality and any recent spike are visible;
• where the visits come from: a site that lives on one referrer, one social post or one search query is fragile;
• which landing pages earn the traffic, and whether they're pages you intend to keep;
• the search queries and pages reported in Search Console, set against what the analytics package counts.

If the seller can provide server logs or hosting statistics, compare them too. Two independent measures that broadly agree are worth more than one perfect chart. Be wary of any figure described as "verified" unless you know who verified it, how and when. DropOps does not verify website traffic or revenue, and nothing on DropOps should be read as doing so.

With access to the site's Search Console you can see two things a buyer cannot see from outside: any manual action for previous spam, and any URL removals, especially a site-wide one, that are still in force. Google's site-move guidance tells the new owner of a purchased domain to check both. Insist on seeing them before you buy.

A clean record there is not a clean bill of health. Google says it detects spam-policy violations "through automated systems and, as needed, human review that can result in a manual action", and that sites violating those policies "may rank lower in results or not appear in results at all." Not every problem arrives as a message.

Outside Search Console, export the backlink profile from a third-party tool and look for links from sites on unrelated topics or in other languages, anchor text that has nothing to do with the business, sudden bursts of new links, and valuable links pointing at pages that no longer exist. Treat the tool's authority score as one vendor's estimate, not Google's view.

If the archive shows the site was built on a domain bought after it expired, ask why. An old name is not a problem in itself, but Google's spam policies treat an expired name repurposed mainly to manipulate rankings with low-value content as abuse, and that is a risk no traffic chart will show you. Our guide to repurposing an old domain safely sets out where Google draws the line.

Ask for an admin walkthrough rather than a written description. You want to know:

• which CMS and version the site runs, and when it was last updated;
• every plugin, theme and extension, which of them are paid, and whether each licence can move to you or must be bought again;
• who hosts the site, what the hosting contract says about transfer or cancellation, and when it renews;
• every admin and user account, including old agency and freelancer logins;
• which third-party scripts, trackers and embeds the site loads, and whose accounts they belong to;
• where the backups are kept, and whether a restore has ever been tested;
• who wrote any custom code, and whether you'll receive the source and the right to change it (see section 2).

Red flags include "nulled" (pirated) premium plugins, admin users nobody can identify, software several major versions behind, and a site that only one developer understands.

The strongest revenue evidence comes from the platform that pays the money: a live login to the payment processor, the affiliate network or the ad network, or exports downloaded while you watch. Match those figures against deposits in the seller's bank statements. A spreadsheet the seller prepared is a summary of a claim, not evidence of it.

Then ask whether the income will survive the sale. Affiliate and advertising accounts are often tied to a particular person or company and may not be transferable, so read each programme's terms. Revenue that rests on the seller's own relationships, such as a few large clients or a personal reputation, may not come with the site. Look at refunds, chargebacks and running costs as well as sales.

DropOps does not provide legal, accounting or financial assurance on any website or business.

A mailing list or customer database is often pitched as one of the most valuable parts of a site. Under UK data protection law it is also an obligation you take on. The ICO's data sharing code says the transfer of databases or lists of individuals is a form of data sharing "whether for money or other consideration", and it puts the onus on the buyer: "It is your responsibility to satisfy yourself about the integrity of the data supplied to you." It adds: "You are responsible for compliance with the law for the data you receive, and you have to respond to any complaints about it."

The code's section on mergers and acquisitions says you "must consider data sharing as part of the due diligence you carry out", and lists what that involves, including to:

• "establish what data you are transferring";
• "identify the purposes for which the data was originally obtained";
• "establish your lawful basis for sharing the data";
• "consider when and how you will inform data subjects about what is happening".

On that last point, the ICO's guidance on the right to be informed says that if you obtain personal data from other sources, "you must provide individuals with privacy information within a reasonable period of obtaining the data and no later than one month", subject to limited exceptions. Build that into the handover plan.

In practice, ask the seller for the privacy notices the data was collected under, any consent records for marketing, where the data is stored and who else can access it. A list with no record of how it was gathered may be a liability rather than an asset. The ICO notes that some of this guidance is under review following the Data (Use and Access) Act, so check the current version before you rely on it.

Whether VAT is charged on the price can depend on whether the sale counts as the transfer of a business as a going concern (TOGC). HMRC's VAT Notice 700/9 explains that "if you sell assets as part of a business which is a going concern then, subject to certain conditions, no supply takes place for VAT purposes and no VAT is chargeable." The notice says nothing specific about websites or domain names. Whether a particular website sale meets the conditions is a question for your accountant, before you sign.

Most handover problems come from doing things in the wrong order: paying before the domain has moved, or changing DNS before anyone has written down where the email goes. Agree the sequence in writing before completion.

When you do start changing the site, our guide to rebuilding a website without losing its SEO covers keeping old addresses working. If you want a sense of what names alone have sold for, our study of 24,675 reported UK domain sales shows what expired .uk names fetched at drop auction. That is a different market from an established website, so treat it as context for the name, not a price for the site.