How does probeo help with due diligence on a website?

A new team, and a site nobody had explained

A new leadership team and a new marketing team were about to take over a large website. Nobody handing it over could say how good or bad it was.

That is the usual position. Whoever built a site knows the pages they worked on. Nobody knows the whole thing.

What they could not see

• How many pages had titles too short to say what the page was for.
• Where meta descriptions were missing, cut off, or copied from page to page.
• Where the structured data was broken, so search engines could not tell what a page was.
• Which of those problems were on the pages that actually mattered.

What probeo showed them

Before they started, probeo gave them a written assessment: what the team was already doing right, what was missing, and what done would look like, with the audit's own numbers set as the targets.

Then they connected Search Console. The search data showed which pages carried the business, and turned the outline into a plan.

What they did with it

They started with a plan rather than an investigation. The assessment was the starting list, and the search data decided the order.

What you can establish without asking

There is no composite score to read off. Google states there is no single page experience signal.1,2,3,4,5,6,7,8

• The declared surface. Sitemaps are public files, capped at 50,000 URLs and 50MB each, so a large site's true size shows up in how many files it needs.
• How much of the sitemap to believe. Google ignores priority and change frequency, and uses the last modified date only when it is consistently and verifiably accurate.
• Crawl directives. robots.txt sits at a fixed public location with a 500 KiB limit, and a disallow does not remove a page from the index; Google may still show the URL without a snippet.
• Real user performance. The Chrome UX Report is public, though coverage is conditional: pages must be publicly discoverable and an origin must clear an undisclosed popularity threshold, so missing data is itself a signal.
• Markup honesty. Structured data is in the page, and must be a true representation of visible content, with violations costing rich result eligibility through a manual action.
• Certificate history. Certificate Transparency logs are append-only and anyone can query them.
• Mixed content. An HTTPS page loading insecure subresources is visible in a browser console, where blockable content is blocked and upgradable content is auto-upgraded.

What transfers with the asset

Some of what you are buying is an obligation. Accessibility conformance is defined at levels A, AA and AAA, and WCAG 2.2 is also approved as an ISO standard. In the US the ADA Title II rule sets WCAG 2.1 Level AA for state and local government content, with compliance dates in April 2027 and April 2028. In the EU, the European Accessibility Act applies from June 2025 and covers e-commerce services, with an exemption for microenterprises.9,10,11

Security posture transfers too, including the gap that is easy to miss: HSTS does not take effect until a browser has made one secure connection and received the header, which is why preloading exists. OWASP's header guidance also lists what should not be there, such as headers that disclose the server and its version.12,13

And the channel itself carries risk. Google offers no guarantee that a compliant site keeps its visibility, makes broad ranking changes several times a year, and says recovery from a drop is neither assured nor fast.14,15

The blind spots that matter in a deal

A manual action is invisible from outside. Google says most issues reported there result in pages ranking lower or being omitted with no visual indication to the user, and it is reported only inside a verified property. Reconsideration takes days or weeks, longer for link-related requests.16

Domain history matters as well. Google's spam policies name expired domain abuse, where a domain is bought and repurposed primarily to manipulate rankings, and sites violating the policies may rank lower or not appear at all.17

If the plan involves moving the site to a new domain, treat that as its own project: keep redirects at least a year, expect temporary fluctuation, allow weeks for a medium-sized site, submit a change of address, verify each property separately, and re-upload any disavow file under the new property.18

What the handover documents do and do not prove

• A sitemap is a discovery aid, not a manifest. It does not guarantee crawling or indexing, and a single file caps at 50,000 URLs and 50MB, so one file is never proof of total size.
• Sitemap metadata is mostly ignored. The protocol calls change frequency a hint, says priority is unlikely to influence position, and Google ignores both.
• The submitted count and the indexed count are different numbers, and routinely differ.
• Example URL lists in the indexing report are capped at 1,000 items and are not guaranteed to show every URL in a status.
• The property you were given may hide half the site. A domain property covers all subdomains and protocols; a URL-prefix property covers only that prefix.

Check which property type you inherited before drawing any conclusion from its numbers.19,20,21,22,23

Reading the states the site is actually in

The indexing report is a description, not a defect list, and Google says pages can be unindexed without an error. Two states matter most on an unfamiliar site. Discovered and currently not indexed usually means Google wanted to crawl but expected to overload the server. Crawled and currently not indexed means it looked and declined, and may or may not index later.22

Duplicates split the same way: a duplicate without a user-selected canonical is an unmanaged cluster, while an alternate page with a proper canonical tag is a working setup that needs nothing.22

Inspect individual URLs and you get what Google holds rather than what is live, plus the canonical you declared next to the one Google selected, which is where a previous owner's intentions and Google's reading diverge.24

On a large site, crawl capacity is its own constraint. Google flags sites with a large share of URLs in discovered and not indexed, and names soft 404s, duplicates and long redirect chains as things that waste it.25

What you inherited besides pages

Some of what comes with a site is an obligation with a date on it.

• Accessibility conformance is claimed per page and per process. It cannot be achieved if part of a page is excluded, and every page in a multi-step process has to conform at the same level.
• In the US, the ADA Title II rule sets WCAG 2.1 Level AA for state and local government web content, with compliance dates of April 2027 and April 2028 depending on population.
• Transport security has a documented first-contact gap: HSTS does not take effect until a browser has made one secure connection and received the header.
• Unknown dependencies are the named risk. OWASP says you are likely vulnerable if you do not know the versions of all components you use, including nested dependencies.
• Consent obligations attach to whoever sets cookies. Consent must be a positive action, and the strictly necessary exemption is narrower than most inherited banners assume.
• Old data is a standing obligation. Personal data should not be kept indefinitely just in case, and retention periods should be documented and reviewed.

Check the security issues report on day one: hacked content placed through a vulnerability can put a warning label on your results.26,10,12,27,28,29,30

What this cannot tell you

An assessment tells you the state of the site, not why it got that way or who decided what. Those conversations still have to happen.

It is also a snapshot. The site keeps changing after you arrive, which is why probeo keeps reading it.

It cannot show you the seller's Search Console. Queries, impressions, coverage and any manual action live behind ownership verification, so they are a request, not a measurement.31,16

It cannot convert missing field data into a traffic figure, because the popularity threshold behind that dataset is undisclosed.4

And it cannot tell you whether liability for past conduct transfers to you. That is a legal question the documentation does not answer.

Questions