Check domain history before buying: a 10-minute checklist

You found a name. Short, clean, and the price is right. Maybe it was on an expired-domain list, maybe someone is selling it outright. You're already imagining the logo.

Would you rent a shop without asking what the last tenant sold? If the answer turned out to be "the police closed them down", you'd want to know before you signed, not after.

A domain works the same way. Every name has a past: what lived at that address, who linked to it, whether Google still walks by. A good past saves you months. A bad one follows you home.

So before you pay, spend ten minutes on five free checks. Together they catch most bad pasts — and each one tells you something different.

Minute 1–3: What actually lived there?

Open the Wayback Machine and paste the domain. Click through a few snapshots, spread over the years. You're answering one question: what was this site about?

What you want to see is a real site. A business, a blog somebody cared about, a publication. What you don't want to see:

• Casino, pharma, adult, or payday-loan content, in any language.
• Pages of garbled text with links stuffed into random words. That's a footprint of a PBN — a private blog network, a set of sites built only to sell links to other sites.
• Thousands of near-identical pages with no human voice.
• A sudden change: years of one topic, then a burst of spam, then nothing.

Look at the last snapshot before the domain died too. A site can be clean for ten years and rotten for its last six months.

If the archive is empty, that's not automatically bad — small sites simply never get saved. It just means this check tells you nothing, and the others matter more.

Minute 4: Is it in Google today?

Search for site:thedomain.com in Google. You're asking: does Google still have pages from this domain in its index?

Three outcomes:

• Pages show up. Good sign. The domain is known and not removed.
• Nothing shows up. Could be nothing — if the domain had no site for a while, Google drops it from the index naturally. But if the Wayback Machine showed a real, live site and site: shows zero pages, be careful. That gap is what a Google penalty can look like from the outside.
• Parked pages show up. The domain sat on a "buy this domain" page. Common, usually harmless, but it means the domain has been idle.

From outside, you can't tell "not indexed because it was empty" from "not indexed because it was penalized." Nobody can. A manual penalty — Google's human reviewers flagging a site for spam — shows up only in Search Console, and you need to own the domain to see that. Before you buy, you're reading footprints, not verdicts.

Minute 5: Is it flagged as dangerous?

Check the domain in Google Safe Browsing. This is the blacklist check — the thing browsers consult before they'll load a site without a red warning screen.

A flag for malware or deceptive content means the domain was serving something bad, recently enough to matter. Walk away, or at least understand you're inheriting a problem that takes time and review requests in Search Console to clear.

Minute 6: Is it blocked on social?

Paste the domain into the Facebook Sharing Debugger. If Facebook refuses the URL or reports it's blocked, the domain was used for spam on their platform — often link spam, comment spam, or fake accounts.

This one catches things Google doesn't. And if your plans include anyone ever sharing your link on social, a block like that is a real problem on day one.

Minutes 7–8: How old is it, and how many times was it dropped?

Look the domain up in a WHOIS history tool. You want two facts: when it was first registered, and how many times it was dropped — a current WHOIS record won't show either, because a drop resets the creation date — meaning the owner let it expire and someone else picked it up.

A domain registered in 2004 and dropped once has one story. A domain dropped six times in ten years has another: nobody ever found it worth keeping. Each drop also breaks the continuity of whatever site lived there.

WHOIS privacy is normal and fine — you're after dates and drops, not the previous owner's name. If the current seller tells you the domain is "aged", the drop history is how you check that claim.

What each red flag means

• Spam topics in the archive. The corner had foot traffic, but the wrong kind. Google's spam policies explicitly call out expired domain abuse: buying an expired domain to pour unrelated or low-value content onto its old reputation. A spammy past makes you look like the next person doing exactly that.
• PBN footprints. The old site sold links. Links bought and sold to game rankings fall under Google's link spam rules, and the domain carrying them is a used tool.
• Not in the index despite a real history. Possibly a penalty. Possibly not. You can't confirm it before you own the domain — anyone claiming a "penalty checker" can is overselling what's knowable from outside.
• A Safe Browsing or Facebook block. The domain was actively used for abuse. Clearing it takes weeks, not minutes.
• Many drops. Not dangerous, just weak. A corner nobody stays on.

Not every bad past is equally bad — some fade, some stick. We break that down in Casino, pharma, adult: not every bad past is the same.

Where our verdict fits

Those five checks tell you what you can see for free. Our checks add what's in our historical link graph — more than 470 million domains, with link observations since 2017 and expired-domain records back to 2006, built from publicly available web data.

You get a verdict — Strong, Mixed, or Weak — with the reasons behind it: who links to the domain (editorial sites, directories, auto-generated pages, toxic links), the top editorial donors, the earliest record we have, and the years it was dropped. Domain Rating by Ahrefs is included as a reference number, never as the whole story.

Two things we don't do, because they can't be done from outside: we don't check whether old links are still live, and we can't see manual penalties. For a deeper walk through all of this, see Check a domain's past before you build on it.

What to do now

1. Run the ten minutes: Wayback Machine, a site: search, Google Safe Browsing, the Facebook Sharing Debugger, and WHOIS for age and drops.
2. If you're browsing lists on ExpiredDomains or a domain auction, install the DD Backlink Strainer — our Chrome extension checks domain lists in a side panel, and the free plan gives you 250 checks a day.
3. Before you commit real money to one candidate, read The $10 test: does Google still trust this domain? — a cheap way to find out if the trust is still there.
4. The day you own the domain, add it to Google Search Console. That's the only place a manual penalty will ever show itself, and you want to know on day one, not month three.
5. If anything in the past looks wrong, keep looking. There is always another domain. There is never another first impression on the one you bought.