The post-acquisition checklist for mergers

You shake hands and finalize the deal. Now what? PwC projects roughly 42,000 M&A deals globally in 2026. Most of them leave someone responsible for an acquired company's domains, URLs and redirects.

An acquired company can bring dozens of domains, thousands of indexed pages and years of links sitting in emails, help docs, partner sites, search results and printed packaging. When the old brand is retired without a plan for those links, retiring an old brand can lead to broken customer journeys, lost traffic and avoidable SEO issues.

Poor post-merger integration is one of the three most commonly cited reasons M&A deals fail, and the acquired company's website is part of that integration. McKinsey's research on marketing integration found that "most customers expect a zero-disruption experience in the early days" after a deal closes. A link that used to work and now returns an error is exactly the kind of disruption customers notice.

Before close: due diligence

Before you sign, you need a full inventory of what you're buying. Most of these items can be done with read-only access, so they fit inside a normal due diligence process. It's also the best time to ask questions, while the people who set everything up still work there.

Inventory every domain

Record each domain, its registrar and expiry date. Look beyond the primary website. Look at country-specific domains, product microsites, dead campaign domains, defensive typo domains. Registrar account exports are a good starting point, but may not capture every domain.

You can check domain renewal charges in expense records and search public Certificate Transparency logs (crt.sh is a free option) for SSL certificates issued to the company's domains and subdomains.

Expired domains get picked up fast. Infoblox observed roughly 65,000 expired domains being re-registered each day in the first half of 2026, and one buyer it tracked had picked up rezilion.com, the domain of a cybersecurity company whose assets were sold to GitLab in 2024.

Who actually owns the domains

Domains are sometimes registered to a founder, an agency or a former employee rather than the company being acquired. Flag any that need to be transferred as part of closing. Plan the order of these changes. Under ICANN's current Transfer Policy, a material change to registrant information can trigger a confirmation process and a 60-day lock on moving the domain to another registrar.

If you plan to consolidate domains into the acquirer's registrar account, ask the current registrar about opting out before the ownership details change, since an opt-out may be available before the change but not afterward.

Map subdomains and DNS records

A careless DNS change can break the acquired company's email on Day 1. That’s why it’s important to remember MX records. Export the full DNS zone, including the TXT records used for email authentication (SPF and DKIM), not just MX.

Then look for records pointing at services the company no longer uses, such as an old help desk, a retired campaign page or a shut-down cloud app. Microsoft calls these "dangling DNS" entries: when a DNS record points to a deprovisioned resource, attackers can take control of the subdomain and host a malicious site or service on it.

Crawl the acquired sites

Capture a full list of live URLs before anything changes. This becomes the source list for your redirect map. A crawler only finds pages linked from somewhere on the site, so combine the crawl with XML sitemaps, the Pages report in Search Console and server logs if you can get them. Old product pages and campaign landing pages are often unlinked internally but still earn traffic from search and external links.

Pull traffic and backlink data

Export top pages from GA4 and Google Search Console along with the pages that earn the most external links. These are the URLs you can't afford to lose. Export this early. Search Console only keeps 16 months of performance data, and access to the acquired company's analytics accounts can disappear when employees leave or agency contracts end.

Find existing redirects

Check server configuration files, CMS plugins, registrar forwarding settings and link shorteners. Redirects are often spread across several tools with no documentation. Common locations include .htaccess files on Apache servers, Nginx config files, WordPress redirect plugins, CDN rules and shortener tools. Export every redirect into one spreadsheet.

Account for links you can't update

List vanity URLs and QR codes printed on packaging, signage, manuals, business cards and trade show materials. These links can stay in circulation for years. Ask marketing and operations for print files rather than memory. Then check where each QR code actually points.

Day 1

Day 1 is about protecting what you just bought. Hold off on changes until the brand decision is made.

Secure registrar and DNS access

Take control of the registrar credentials first. Move domains into the acquirer's registrar account once you've confirmed the transfer plan, since a change of registrant can trigger a 60-day lock. Turn on auto-renew and registrar lock for every domain, then check what auto-renew depends on. Update the account contact emails to a shared inbox so renewal notices don't go to someone who's leaving, and confirm the payment card on file isn’t going to be cancelled.

Next, reset passwords and add multi-factor authentication on every account that can change DNS records, including any separate DNS host, CDN or hosting control panel.

For your most important domains, ask your registrar about registry lock, which requires an extra verification step before any change goes through. Apply it after you've consolidated domains, since it also blocks registrar transfers.

Keep the acquired sites live

Unless redirects are part of an approved Day 1 transition plan, keep the acquired sites running while the brand and migration strategy is finalized. Avoid retiring domains or changing live redirects before their destinations have been confirmed and tested.

"Live" also means paid for. Hosting, CMS licenses, CDN plans and SSL certificates are often among the first contracts flagged for cancellation in vendor consolidation, and a lapsed one can take the site down before anyone decides its future.

Certificates need particular attention. Since March 15, 2026, newly issued public SSL certificates can be valid for no more than 200 days, dropping to 100 days in 2027 and 47 days in 2029. A renewal process that relied on one person at the acquired company will fail faster than it used to.

Publish an announcement page

Give customers one clear place to learn what's changing, what isn't and when. Answer the obvious questions in an FAQ, like what will be different and whether their service will be affected, then add the practical ones customers won't think to ask until something breaks: whether their login, bookmarks and saved links will keep working.

Link to the page from a banner on the acquired site. Choose a URL you plan to keep, since it will end up in press releases, news coverage and customer emails that you can't edit later.

First 30 days: plan the move

The redirect work you do in the next two months depends on decisions made here. Most of the effort goes into the redirect map.

Decide the brand strategy

You might absorb the acquired brand fully, keep it as a sub-brand or run both side by side. This decision drives every URL decision that follows.

The most common outcome is also one of the heaviest for redirect work. McKinsey found that in roughly 40 percent of mergers, companies choose a single brand based on one of the legacy brands, and that three-quarters of companies make the transition gradually rather than all at once. The technical migration may follow a different timeline, so plan your redirect rollout around when websites and content are actually moving.

Build a one-to-one redirect map

Match each old URL to the most relevant destination. Some pages will have direct equivalents, while others may point to a consolidated page, product page or leave it as a 404. Avoid sending everything to the homepage. Google may treat mass homepage redirects as soft 404s, which means those old URLs fall out of the index and the redirect is not used as a canonical signal for the homepage. Start with the URL list and traffic data you gathered during due diligence, and work through the highest-value pages first.

What a redirect map looks like:

That last row is important. If a page has no relevant equivalent, it's better to let it return a 404 or 410 than to redirect it somewhere unrelated. Google may treat a redirect to an irrelevant page as a soft 404 anyway, and it confuses the visitor in the process.

Choose the right redirect type

Use 301 or 308 redirects for retired pages and domains. Google uses these as a strong signal that the destination should be the canonical URL, while temporary redirects (302 and 307) are only a weak signal, so Google usually keeps showing the old URL in search results. An acquisition is almost always a permanent move.

Make every old URL reach its destination in one hop

If the acquired site already redirects old URLs, update those rules to point to the final destination instead of stacking new redirects on top. The same goes for URL variants: HTTP, HTTPS, www and non-www versions should all go straight to the final page.

A common mistake is a three-step path where HTTP goes to HTTPS, then non-www goes to www, then the old domain goes to the new one. Google's crawlers follow up to 10 hops, but every hop slows the page for visitors and adds another place for the redirect to break. Every hostname that answers over HTTPS, including the old domain's www and non-www versions, needs a certificate that covers it, or the browser throws a security warning before the redirect ever runs.

Preserve query strings

Confirm UTM parameters and other query strings pass through the redirect. Otherwise campaign attribution breaks during the transition. Some redirect setups drop everything after the question mark by default.

Test it before launch by clicking a tagged link, such as acquiredco.com/pricing?utm_source=newsletter, and checking that the full parameter string survives on the destination page. Email campaigns, ads and partner links already in circulation all depend on this.

30 to 90 days: launch and clean up

The map goes live here, and the old domain starts handing its traffic over. It's also where small mistakes surface, usually as a support ticket from a customer whose bookmark stopped working.

Part 1: Launch the redirects

Work through these in order:

1. Test the redirect map before launch.

Run the full URL list through a redirect checker and confirm every source returns the right status code and destination. A good test reports three things for each URL: the status code, the final destination and the number of hops it took to get there.

Most SEO crawlers can do this in list mode, where you paste in URLs rather than crawling a site. Anything showing more than one hop, a 302 where you expected a 301 or a destination that doesn't match your map needs fixing before launch.

2. Launch during a quiet window.

Pick a time with low traffic and no active campaigns, and make sure the people who built the map are available for the next few days.

3. Launch and verify.

Re-test after go-live. Spot check high-traffic pages and top backlink targets manually. Run the same URL list through the checker again. A map that passed in staging can still fail in production because of caching, CDN rules or a server setting that was forgotten.

4. Watch the first two weeks closely.

Check Search Console for indexing and redirect issues, review 404 logs for missed URLs and use redirect-level analytics to monitor traffic still arriving through legacy links. Expect some ranking movement while Google processes the change. Watch for pages that lose visibility and fail to recover as the migration progresses.

Part 2: Tell Google about the move

If you're moving an entire domain, submit the move with Google's Change of Address tool in Search Console. It tells Google to prioritize crawling and indexing the new site over the old one. You'll need owner access to both properties under the same Google account, and the old homepage should already 301 redirect to the new one.

The Change of Address tool supports moving an entire domain into a subfolder on another domain, but it cannot be used to move individual folders or pages within an existing site.

Part 3: Remove references to the old domain

Update internal references.

Fix internal links, XML sitemaps, canonical tags and hreflang annotations so they point to final URLs rather than relying on redirects. This applies to the destination site too. Content migrated from the acquired site often carries old internal links, canonical tags pointing back to the old domain or image URLs still hosted there. A crawl of the new site filtered for the old domain name will catch most of them.

Update customer touchpoints.

Help center articles, onboarding emails, invoices, in-app links and email signatures often reference the old domain. These links are often spread across teams with no single owner.

Assign each team its own list:

Reach out about top backlinks. Ask the highest-value referring sites to update their links to the new URLs. Start with links you control or can easily influence: partner pages, integration directories, reseller listings and review site profiles. Then move to editorial links from sites with real traffic. You won't get every link updated, which is why the redirects stay in place, but a direct link avoids a hop and protects you if a redirect is ever removed by mistake.

Ongoing: after the integration team moves on

This is where redirect management often loses ownership. Integration teams disband after a few months, but the old links keep getting clicked for years.

Monitor 404s and redirect traffic

Watch for URLs the map missed and track how much traffic still comes through old links. Use this data to identify gaps in your redirect map and prioritize ongoing maintenance, rather than assuming declining traffic means redirects are safe to remove.

Keep redirects in place

Google recommends keeping redirects for at least one year after a site move; we recommend keeping them in place for as many years as they continue to receive clicks. For links on printed materials or in long-lived partner content, keeping them indefinitely is safer.

Never let old domains lapse

An expired domain can be registered by anyone, including people who want to exploit the old brand's traffic or reputation. Keep renewing domains you no longer actively use.

Assign a long-term owner

Name a person or team responsible for redirects and domain renewals. Document every domain and redirect rule in one place so the knowledge doesn't leave with the integration team.

Where urllo fits

By the time the integration team disbands, nobody can list every place a redirect lives.

urllo gives teams a centralised place to manage redirects across their domain portfolios, without maintaining separate redirect servers for each legacy domain.

You can upload redirects in bulk, automatically manage SSL/TLS certificates for domains configured with urllo and see which old links are still getting traffic. Plus, UTM parameters are preserved during redirects.

urllo handles over 25 billion requests a year for more than 1,000 companies across 75+ countries.

Frequently asked questions

How long should redirects stay in place after an acquisition?

Google recommends at least one year after a site move. If old URLs appear on printed materials, partner sites or long-lived content, keep the redirects in place indefinitely.

Should we redirect the acquired domain to our homepage?

No. Redirect each page to its closest equivalent, and let pages with no relevant replacement return a 404 or 410. Page-to-page redirects preserve search value and send visitors to what they were actually looking for.

What happens if we let an acquired domain expire?

Anyone can register it once it's released. That can mean lost traffic, broken links and a risk that someone uses the old brand's reputation for spam or phishing.

Who should own redirects after the integration is done?

Assign a named owner, usually in marketing ops, web operations or IT. The key is that ownership is written down and survives the integration team disbanding.

By Sarah Ellis

Director of Enterprise Accounts

Sarah is a passionate sales and management leader with over two decades of experience in the start-up, technology, real estate and music/advertising sectors. Sarah started her entrepreneurial journey years ago when she founded and ran her own bakery. Which is why she’s still the premier source of baked goods inside the urllo office.