Website Due Diligence and Technical Debt

The Review Nobody Schedules

Somebody is going to look at this business before the deal closes.

If you are buying, it is the lender or the accountant who asks to see the website on their own screen, and the technical reviewer who opens it on a phone and watches it load. If you are taking over a family business, it is the family member who hands you the login details and mentions, almost in passing, that the site has been “a bit of a mess since the last person left”.

Whatever the reason, the review has a fixed checklist. The people doing it almost never look at the website in the way a customer does. They look at the parts they can check quickly, because the due diligence they have in mind stops at the accounts:

┌────────────────────────────────────────┬────────────────────────────────────┐
│               WHAT THE REVIEWER LOOKS AT, AND WHAT THEY SKIP                │
├────────────────────────────────────────┼────────────────────────────────────┤
│ THE BACK OFFICE (ALWAYS CHECKED)       │ THE WEBSITE (USUALLY SKIPPED)      │
│ Accounting and the bank                │ A 4.2s mobile load                 │
│ Stock, equipment, leases               │ A contact form that fails          │
│ Contracts and tax position             │ Hosting on a wasted plan           │
│ Customer list and staff                │ A site that cannot be moved        │
└────────────────────────────────────────┴────────────────────────────────────┘

The site is filed under marketing, and marketing is not what the review is about. So it sails through.

Except the site is not marketing material. It is where the orders come from, where the enquiries land, and where the customers who never phone first will decide whether they trust you. And a website that has been left alone for four years carries exactly the kind of quiet problems that a general inspection does not look for.

1. The Five Checks

The review that matters is short. Five checks, and each one answers a question a buyer or lender will ask out loud later.

┌────────────────────────────────────┬────────────────────────────────────────┐
│                               THE FIVE CHECKS                               │
├────────────────────────────────────┼────────────────────────────────────────┤
│ CHECK                              │ WHAT YOU LOOK AT                       │
│ Speed on a real phone              │ Google PageSpeed Insights              │
│ Security                           │ Platform and plugin issues             │
│ Ownership                          │ Domain, hosting, code                  │
│ Cost                               │ What it costs every month              │
└────────────────────────────────────┴────────────────────────────────────────┘

Check 1: Speed on a real phone

Open the site on a phone, on mobile data, not on the office wifi. Google publishes free field data through the Chrome UX Report and a per-URL report through PageSpeed Insights, which also shows what the experience looks like on a mid-range phone.

Two numbers matter. Largest Contentful Paint is how long the main content takes to appear; Google treats under 2.5 seconds as good. Interaction to Next Paint is how long the page takes to respond when someone taps; under 200 milliseconds is good. web.dev sets out the full set of thresholds.

A four-second load is not a technical complaint. It is the reason somebody reading your site on the bus closed the tab.

Check 2: Whether the forms actually work

Send yourself a message through the contact form. From a phone, not a laptop. Check it arrives, and check the reply address is one you actually read.

This is the check most likely to be skipped and most expensive to skip, because a broken form fails quietly. It does not show an error to the business. It just does not deliver, and you find out months later when a customer says they tried to get in touch.

Check 3: Security

If the site runs on a well-known platform, find out which version it is on and whether the plugins are current. Patchstack’s 2025 figures record 10,230 vulnerabilities in WordPress plugins for that year, and 42% of the vulnerabilities published that year were still unpatched when the figures were compiled. An out-of-date site with an old theme is a waiting list.

Check 4: Ownership

Ask the three questions that decide whether you can actually take this over:

• Who owns the domain? The registrar account, in the business’s name.
• Who owns the hosting? The account, in the business’s name.
• Who owns the code and the content? The repository and the CMS, in the business’s name.

If any of these sit in the previous owner’s personal account, in the previous designer’s account, or in the web agency’s account, then you do not own the site. You are renting it, and the rent can change without warning.

Check 5: What It Costs

Add up everything the site costs every month: hosting, the platform subscription, a plugin or two, a maintenance retainer. For a small business this is often a few hundred dollars a year that nobody has looked at since the launch, because it has never been itemised.

2. What Technical Debt Actually Looks Like

Technical debt is not a dramatic failure. It is a set of small postponements that each made sense on the day and add up to something you cannot change without help.

• A site built on a platform that was convenient in 2019 and now needs a plugin patched by hand every few weeks.
• A page that has grown to 4,000 lines of custom code, understood by one person who left in 2023.
• Images uploaded at full camera resolution, so a page that should weigh 400KB weighs 4MB.
• A hosting plan sized for a spike in 2021, paying for traffic the business no longer has.
• A rebuild that is “next quarter” every quarter.

None of that is anybody’s fault. It is what happens when a business does not have a maintenance budget and treats the site as a thing that was dealt with, rather than a thing that runs.

┌─────────────────────────┬────────────────────────┬──────────────────────────┐
│                         WHAT A BETTER SETUP CHANGES                         │
├─────────────────────────┼────────────────────────┼──────────────────────────┤
│ THE LEVER               │ BEFORE                 │ AFTER                    │
│ Mobile load time        │ 4.2 seconds            │ Under 1 second           │
│ Enquiries that arrive   │ Some forms fail        │ Forms tested on a phone  │
│ Monthly site cost       │ $45 hosting, $30 plan  │ About $5 hosting         │
│ Ownership               │ One account            │ Your own repository      │
└─────────────────────────┴────────────────────────┴──────────────────────────┘

The “after” column is not a promise. It is what a small static site on edge hosting typically looks like, and it is worth knowing the target before you accept a quote that says “it will be fine as it is”.

3. What to Do With What You Find

Sort the findings into three piles, and resist the temptation to fix everything at once.

Fix now. A form that does not deliver, a domain in the wrong name, a site that is not backed up. These are cheap and they are not negotiable.

Plan for. The rebuild, the platform migration, the image cleanup. These need a scope and a date.

Ignore. Everything else. Most of what a thorough audit finds does not need to be fixed this year, and a review that produces a list of forty items is a list nobody works through.

The honest summary for a buyer is short: here is what the site costs, here is what it does, here is what it will cost to bring it up to a reasonable standard, and here is the schedule. Most small-business websites are a few thousand dollars of work, not a rewrite, and knowing that before you close is worth more than any spreadsheet.

Conclusion: The Site Is Part of the Business

A website is not a poster for the business. It is a working part of it: it takes the orders, it answers the questions, and it is the only version of you that is open at 2am.

So when somebody reviews this business — a buyer, a lender, a family member taking over — they will look at the site, whether or not anybody put it on the list. Give them something good to look at: fast, working, owned by the business, and cheap to keep running.

Want an audit of your own site before you sell, lend against it or hand it over? Model the scope with our estimator or tell Jorge what you are planning.