If you're not worried about the payment then what is it that bothers you about the legality of the client's business or his identity? Provided he's not selling

If you're not worried about the payment then what is it that bothers you about the legality of the client's business or his identity? Provided he's not selling illegal firearms, performing scams or distributing child pornography I don't see any reason to worry about it. On top of that you will see his site, so you will know what kind of business he is in from the start. It's not like everyone is googlable or should be. I'd say being able to google somebody's name and get tons of results is the exception rather than the rule (and thank $DEITY for that). Your concern for getting direct access to his website is valid though. If the customer is not using any VCS I'd suggest to him that he starts doing so - there are plenty of options. If the client can provide you access to a testing/dev environment, where you can safely play with things without breaking production, I'd pick that option as well.