How to Verify Website Traffic Before Buying (Never Accept Screenshots)

Open any analytics dashboard, press F12, double-click a number, and type a different one. Screenshot it. The whole operation takes about thirty seconds and leaves no trace, because a screenshot is a picture of a web page, not evidence about a business.

This is not a theoretical risk. Traffic is the headline number in almost every website listing, and the easiest number in the entire deal to fake. Everything downstream — revenue per visitor, growth projections, the multiple you agree — is computed from it.

Why This Is a Walk-Away Item

Most due diligence findings adjust the price. This one decides whether there is a deal at all, because a seller who will not let you see live data is telling you something about the data.

• Forgery is trivial and deniable. Editing rendered HTML requires no skill and no software. A PDF export is no better: it is generated from whatever was on screen.
• It is the input to everything else. If traffic is overstated by 40%, every derived figure in the listing is wrong by 40%, including the one you are paying a multiple on.
• Refusal is itself the answer. Granting read-only access costs the seller twenty seconds and gives away nothing. There is no legitimate reason to decline.

Treat this the way you would treat a seller refusing to let you view a house.

Step 1: Ask for Read-Only Access, Precisely

Vague requests get vague answers. Name the role.

In Google Analytics 4, ask to be added as a Viewer on the property. Google's access management documentation defines Viewer as being able to see settings and data, change report views, and build their own explorations — and nothing else. The seller keeps full control; you cannot alter a single setting.

The path they follow is Admin → Property → Property access management → add your email → Viewer.

Two things to check when the invitation arrives.

First, the role you were actually given. "Viewer" is what you want; being added at a lower level, or to a single report rather than the property, limits what you can reconcile later.

Second, whether a data restriction was applied. GA4 lets an administrator attach No Cost Metrics or No Revenue Metrics to your access. Restricted metrics display as 0 rather than being hidden, which is the dangerous part: a revenue column reading zero looks like a fact about the business when it is actually a fact about your permissions. If you see implausible zeros, ask whether a restriction is on your account before drawing any conclusion.

Also request Search Console access at the same time, since you need it for the penalty and algorithmic-hit check anyway. One request, two checks.

Step 2: Confirm You Are Looking at the Right Website

This is the step almost nobody performs, and it defeats the most effective version of the scam: being shown a real, healthy analytics property that belongs to a different site.

The check takes a minute and the seller cannot interfere with it.

1. Open the live website and view the page source, or open DevTools and filter network requests for gtag or collect.
2. Find the GA4 measurement ID. It looks like G-XXXXXXXXXX.
3. In the GA4 property you were given, go to Admin → Property → Data streams and open the web stream.
4. The measurement IDs must match exactly.

If they do not match, you are not looking at this website's data. There is no innocent explanation that does not involve the seller correcting the access immediately.

While you are in Data streams, note how many streams the property has. A property collecting from several domains or apps reports them together, so the figures you are being shown may include traffic from properties that are not for sale. Check the hostname breakdown before accepting any total.

Step 3: Find the Filters That Delete Traffic

GA4 can permanently discard data before it is ever recorded, and the result looks like clean, unremarkable analytics.

Go to Admin → Data display → Data filters. Google documents three types: Developer traffic, Internal traffic and Web hostname traffic. Each filter has a state:

The word that matters is permanently. Google's documentation is explicit: data removed by an active exclude filter is never processed and will never be available in Analytics or BigQuery. It is not hidden, it is gone, and no permission level you are later given will bring it back.

For a buyer this cuts both ways, and you need to work out which:

• An internal-traffic filter is normal and good. Excluding the owner's own IP is standard practice and makes the numbers more honest, not less.
• A hostname filter can be hiding a staging environment — fine — or excluding a subdomain that was part of the business. Ask which.
• An include-only filter is the one to examine closely. Google applies active "Include only" filters first, as a group, before any exclude filters. An include-only filter narrows the entire dataset to whatever it matches, and everything else is discarded.

Note also that data filters do not affect historical data. A filter switched on six months ago creates a step change in the trend at that date which has nothing to do with the site's actual performance — and a seller may well present that step as the result of something they did. Check filter creation dates against any inflection in the graph.

There is a limit of ten data filters per property, so this is a short list to review. Read all of it.

Step 4: Check the Tag Is on the Whole Site

Analytics only reports what it is installed on. A tag present on the homepage and missing from half the article templates produces a believable, internally consistent, badly understated — or overstated — picture.

• In GA4, open Reports → Engagement → Pages and screens and compare the number of distinct page paths receiving traffic against the number of pages the site actually publishes. You established that figure when you checked how many pages are indexed.
• Spot-check five article URLs directly: open each one with DevTools on the Network tab and confirm a request to google-analytics.com or googletagmanager.com fires.
• Watch for double tagging. If the same page fires the tag twice, sessions and pageviews are inflated and the bounce rate collapses to something implausibly low. An unusually low bounce rate is more often a tagging fault than a sign of brilliant content.

Step 5: Check How Far Back the Data Actually Goes

GA4 applies a data-retention setting to user and event-level data, and once that window passes the detail is gone. Check Admin → Data display → Data retention and note the configured period.

This matters because a 12-month trend you cannot reconstruct is a 12-month trend you are taking on trust. Where retention has already truncated the history, Search Console's Performance report covers 16 months and is a useful independent record — one more reason to request both accesses together.

Also check the property creation date. A property created eight months ago on a site sold as a four-year-old business means there is no analytics history for the first three years, whatever the seller says about it. Cross-reference against what the Wayback Machine shows the site was doing in that period.

Step 6: If They Will Not Grant Access — the Screen-Share Protocol

Sometimes a seller has a reason: a single property covering several businesses they do not want to expose. It is a weak reason, but it happens. The fallback is a live screen share, and it only works if you drive.

Rules that make it meaningful:

1. You dictate the navigation, out loud, in real time. They share the screen and click where you say.
2. Start from a logged-in Analytics home page, not from a pre-opened report. You want to see the account list and the property list.
3. Ask for date ranges you choose on the spot, including odd ones — 14 March to 2 June, say. Pre-prepared fakes break under unrequested ranges.
4. Have them open Admin → Data filters and Admin → Data streams while you watch.
5. Have them send a fresh invite during the call. If the data is real, there is no reason not to.

A seller who will not do this under your direction has answered the question. Note that both item 007 and item 018 on the due diligence checklist are flagged for exactly this: do not trust screenshots, and a seller refusing live access is a stop.

Step 7: Cross-Check Against Something the Seller Does Not Control

Analytics is the seller's house. Corroborate from outside it.

• Search Console is a separate Google product with its own access. Organic clicks there should be in the same region as organic sessions in GA4. They will never match exactly — different definitions, different attribution — but they should not disagree by multiples.
• The ad or affiliate network dashboards report their own sessions or impressions. Those numbers come from a third party with no interest in the sale.
• Third-party estimates from Ahrefs or SEMrush are crude but independent. A large divergence is a prompt to ask questions, and it has its own place on the checklist.

Agreement across sources that cannot easily be coordinated is the strongest evidence you will get.

What to Do With What You Find

Quick Reference Checklist

Before signing off on this item:

• GA4 Viewer access granted on the property, not a screenshot or an export
• Checked whether a No Cost Metrics or No Revenue Metrics restriction applies to your access
• Measurement ID on the live site matched against the property's Data streams entry
• Number of data streams checked, and hostname breakdown obtained if more than one
• Admin → Data display → Data filters reviewed in full, with each filter's type and state recorded
• Filter creation dates compared against any step change in the traffic graph
• Tag presence confirmed on five article URLs, not just the homepage
• Checked for double tagging via an implausibly low bounce rate
• Data retention period and property creation date noted
• Search Console access requested in the same conversation
• Organic sessions cross-checked against Search Console clicks and network dashboards

This is the gateway item for the whole Traffic & Analytics section. Everything after it — trend analysis, traffic concentration, geography, bot detection — assumes the numbers are real. Spend the thirty minutes here before you spend any time on the rest.