Last updated: October 28, 2026
Quick Answer: buying a WordPress site safely usually means verifying the business, the ownership, and the transfer before any money leaves escrow. The safest path is to check the traffic and revenue claims, confirm the domain and hosting are transferable, and release funds only after every account you need is in your name. If you are learning how to buy a WordPress site safely, start with control, not price.
Key Takeaways
- A safe purchase starts with proof, not promises: ownership, analytics, revenue, and access all need to line up.
- Escrow reduces payment risk, but it does not fix bad data or missing logins.
- The domain registrar matters as much as the website itself; without it, the site can be hard to control.
- Google Analytics, hosting, and admin access should all be checked before closing.
- If the seller cannot show clean records for the last 3 to 6 months, walk away.
Start with the right questions before you pay
The first question is whether the site can actually be transferred cleanly. If the answer is not yes across the domain registrar, hosting provider, WordPress admin, and analytics account, the deal is not safe yet.
Begin by asking for three things: proof of ownership, proof of performance, and proof of transferability. Proof of ownership means the seller controls the domain registrar account and the hosting account. Proof of performance means the revenue or traffic claim can be checked against Google Analytics, Search Console, ad dashboards, or payment records. Proof of transferability means the seller can move every asset you need without hidden dependencies such as a private plugin license, a personal email tied to recovery, or a custom script stored on their server.
A safe buyer does not start with price. A safe buyer starts with control. If the site earns through affiliate links, ads, or products, ask where the money actually lands. If it runs on WordPress plus a page builder, ask which licenses are paid yearly and which expire after transfer. If the seller says “it’s all standard,” ask for the exact plugin names and the renewal dates.
A site that looks fine in a sales listing can still be fragile. A theme license may be non-transferable. A domain may be locked at the registrar. A hosting account may be shared across multiple sites. Any one of those can turn a clean-looking purchase into a long support fight.
If you cannot get a straight answer in the first exchange, that is useful information. The deal may still exist, but the risk is already rising.
How do I buy a WordPress site safely?
You buy a WordPress site safely by following a fixed sequence: verify, reserve, transfer, then unlock payment. That order matters because each step removes a different kind of risk.
-
Collect the asset list first.
Ask for the domain name, hosting provider, WordPress admin login, Google Analytics access, Search Console access, email accounts tied to the site, and a list of paid plugins or themes. When this works, you have a complete map of what is being sold, not just a URL. -
Check the traffic and revenue evidence.
Compare the seller’s screenshots with live access to Google Analytics and any income source, such as ad networks, affiliate dashboards, or Stripe/PayPal records. A working check shows matching dates, source data, and account ownership, not just a cropped image from a phone. -
Confirm the domain registrar and hosting provider.
Log into the registrar and the host, or have the seller demonstrate access on a screen share. The domain should be unlocked for transfer if needed, and the host should show a plan that can move to your account. A good sign is that the seller can navigate to DNS, billing, and support without hesitation. -
Use escrow before any transfer starts.
Put the purchase in escrow, then fund it only when the terms are written down. The agreement should state what must transfer, when the transfer is complete, and what happens if a login is missing. Escrow helps most when both sides know the release condition in advance. -
Transfer one critical account at a time.
Start with the domain registrar, then hosting, then WordPress admin, then analytics and email. After each transfer, log out and log back in with your own credentials. A successful step is simple: the old owner no longer controls recovery options. -
Check the site immediately after transfer.
Open the homepage, a blog post, checkout pages if they exist, contact forms, and analytics tracking. If pages load, forms send, and tracking still records visits, the handoff is working. -
Only release escrow after the site is fully under your control.
Money should move last, not first. If the seller still has admin access or registrar control, the deal is not finished.
This workflow is slower than sending a wire and hoping for the best, but it is often less risky. It is also the difference between buying an asset and buying a problem.
What to check in due diligence before the deal closes
Due diligence on a WordPress site is about finding the gap between what the seller says and what the accounts show. The biggest mistake is trusting a single screenshot, especially if the site looks polished or the niche sounds familiar.
Start with the traffic history. Google Analytics should show steady access over time, not one neat month cropped from a dashboard. Look for sudden spikes, flat lines, or traffic that depends on one source. Sites that rely heavily on a single channel can be more exposed if that channel changes. Search Console helps here because it shows whether search visibility has been growing, holding, or dropping.
Next, check revenue quality. A site that earns from affiliate programs or ads may appear healthy while actually relying on one unsteady product or one season. Ask for at least 3 to 6 months of payment records where possible, then compare those records with the traffic pattern. If the revenue appears to outrun the traffic, that is a warning sign, not a win. For general guidance on evaluating online-business records, see the FTC’s advice on spotting misleading claims and unusual payment pressure at https://consumer.ftc.gov/articles/online-scams.
Then inspect the WordPress stack. Find out which theme the site uses, which plugins are active, and whether the design depends on a page builder such as Elementor or a custom child theme. A site that breaks if one plugin license expires is not a low-maintenance asset. It is a dependency chain.
Content matters too. Look at the age of the posts, whether images are licensed, and whether the site has duplicate or spun content. If the site sells products, review refund terms and checkout flow. If it depends on email subscribers, ask who owns the list and what service holds it.
A generic buyer often asks, “Does it make money?” The better question is, “Would this still make money if one account changed tomorrow?” If the answer is no, the site is weaker than it looks.
For traffic verification, Google’s own documentation on Analytics and Search Console is the best starting point: https://support.google.com/analytics/ and https://support.google.com/webmasters/.
The ownership transfer checklist that prevents ugly surprises
Ownership transfer is where many deals fail because the seller transfers access in pieces instead of transferring control. The fix is to move the assets in a deliberate order and verify each one from your side; if the deal is complex, it is wise to consult a qualified lawyer, accountant, or broker before closing, especially for tax or contract questions.
First, move the domain at the registrar. The domain is the site’s address, and without it, you may not control the brand or the redirects. Check that you can edit DNS records, nameservers, and WHOIS or contact settings where relevant. If the registrar still shows the seller as the only admin, the transfer is not yet complete.
Second, move hosting into your account or to a host you control. A clean transfer gives you billing access, file access, database access, and backup access. If the site uses managed WordPress hosting, make sure the host account itself is not shared with other properties you do not own.
Third, replace every login tied to the seller’s email. That includes WordPress admin users, plugin dashboards, analytics, Search Console, email service accounts, backup tools, CDN accounts, and any payment processor linked to the site. A working transfer leaves no recovery path in the seller’s inbox.
Fourth, rotate passwords and API keys. That covers WordPress admin passwords, hosting passwords, SFTP or SSH keys, database credentials, and any API keys used by forms, newsletters, or analytics. If the seller can still log in with an old key, the site is not fully yours.
Fifth, test the site as an owner and as a visitor. Open the front end in a browser, submit a contact form, load a post with images, and confirm that the tracking code still fires in Google Analytics. If the backend works and the front end behaves normally, the transfer is taking hold.
The hard truth is that a “successful handoff” is not a message in email. It is the absence of seller control in every critical place.
Escrow, contracts, and the payment release point
Escrow protects the money, but only if the release terms are precise. A vague agreement is a weak shield, especially in a deal that depends on multiple accounts and credentials.
Use written terms that say exactly what must be delivered: the domain transfer, the hosting transfer, WordPress admin access, Google Analytics access, and any other agreed assets. If the site includes premium plugins or a theme license, the agreement should say whether those licenses transfer or expire. If the seller says they do not transfer, that should be written into the price you negotiate, not discovered later. For escrow basics, see Escrow.com’s general guidance at https://www.escrow.com/learn.
Keep the release point tied to control, not to time. A fixed date can help, but do not make it the only trigger. If the seller has not handed over a domain, a hosting plan, or a critical dashboard by the deadline, the escrow agent should not release funds automatically.
A common mistake is paying outside the agreed process because the seller wants to “speed things up.” That can cost the buyer leverage when a login is missing or a transfer stalls. Another mistake is accepting a site “as-is” without listing the assets that define the site’s real value. That can leave the buyer with a WordPress install but no traffic source, no email list, and no control of the domain.
Be careful with promises that depend on future cooperation. If the deal requires the seller to fix redirect rules, move a license, or complete a support ticket after closing, that is a dependency you must price and document. A smooth handoff is best; a promise to “help later” is not enough.
Escrow is not a magic word. It is a process. When it works, both sides know what counts as delivery, and the money stays parked until delivery is real.
What to do in the first 48 hours after purchase
The first 48 hours after purchase are for proving that the site is stable under your control. If something breaks here, it is much easier to fix while the transfer is still fresh.
Start by checking the front end on desktop and mobile. Open the homepage, the top traffic pages, the contact page, and any sales or checkout pages. If the site uses a caching plugin or CDN, clear cache once and check again. A page that loads only from cached copies is not healthy.
Then confirm analytics. Open Google Analytics and verify that live or recent activity still records visits. If the site uses event tracking, test the main event at least once. If the site gets no visible activity after you visit multiple pages, the tracking code may have been removed or broken.
Next, test email. Submit a form, trigger a password reset, and check whether messages arrive in the right inbox. Many site sales fail quietly here because the site still sends mail from the seller’s old SMTP account or from a server that never got reconfigured.
Check backups within 24 to 48 hours. Make sure you know where the backups live, how often they run, and how to restore one. A site without a working backup plan is one outage away from becoming a support project.
Finally, review all remaining access. Remove the seller from every system that matters and change any credentials they may have known. A buyer who leaves old access in place is inviting trouble later, even if the first week feels fine.
This stage is not glamorous, but it is where hidden transfer problems usually show themselves. If the site survives these checks, the purchase has likely cleared the most dangerous part.
How do I avoid scams when buying a site?
You avoid scams when buying a site by refusing to rely on screenshots, rushed deadlines, or unverifiable claims. Ask for live access to Google Analytics, the domain registrar, and the hosting provider, then compare those accounts with revenue records and WordPress admin access. If the seller resists any one of those checks, the risk is too high.
What documents should I request?
You should request proof of ownership, access credentials, transfer terms, and performance records. At minimum, ask for registrar details, hosting account details, Google Analytics access, Search Console access, a list of plugins and licenses, and recent revenue evidence if the site earns money. If the site is tied to contracts or licenses, get those terms in writing too.
How do I confirm ownership transfer?
You confirm ownership transfer by logging in with your own credentials and seeing the seller removed from recovery paths. The domain registrar should show you as the account holder or admin, hosting should be in your account, and WordPress, analytics, and any payment tools should use your email and password. If the seller can still reset access, the transfer is not finished.
Drafted with AI; not yet reviewed by a person.