Buying an online business requires more than confirming its headline revenue. This reusable due diligence checklist helps you verify traffic, income, expenses, customers, technology, ownership, and seller claims before you commit—and gives you a practical system for revisiting the numbers as new information arrives.
Overview
Due diligence is the process of testing whether a business is what the seller says it is, whether its performance can be transferred to you, and whether the risks fit your acquisition plan. The same principles apply whether you want to buy a profitable website, a SaaS product, a content site, a newsletter, or another digital asset.
A listing or seller presentation is a starting point, not proof. Treat every important claim as a question to verify. “Monthly revenue” should connect to payment records. “Organic traffic” should appear in an analytics account. “Low operating costs” should match invoices, subscriptions, and bank or accounting records. “Proprietary technology” should be supported by an inventory of code, domains, accounts, and intellectual property.
Use a simple evidence log with five columns:
- Claim: What the seller says is true.
- Evidence requested: The report, account view, contract, or document that supports it.
- Status: Verified, partially verified, unclear, or contradicted.
- Risk: The potential effect on value, operations, or transferability.
- Next action: The question, document, test, or specialist review still needed.
Keep this record updated throughout the deal. New information can change your valuation, purchase structure, transition plan, or decision to proceed. For a broader introduction to the process, see this website due diligence checklist and the guide to what to verify before buying a website.
What to track
1. Revenue and payment evidence
Start with a monthly revenue schedule covering a period that is long enough to reveal seasonality and unusual months. Compare the seller’s summary with source records from payment processors, commerce platforms, invoices, affiliate networks, advertising accounts, or subscription billing systems.
- Separate recurring, one-time, affiliate, advertising, sponsorship, and product revenue.
- Match gross sales to refunds, chargebacks, taxes, payment fees, and net receipts.
- Identify revenue tied to a single customer, channel, partner, or product.
- Check whether recent growth came from a repeatable activity or a temporary event.
- Confirm which revenue streams and customer relationships are included in the transaction.
Do not value the business from its strongest month alone. A useful valuation model should reflect normalized earnings and the risks you identify. The online business valuation guide can help you organize the assumptions behind that calculation.
2. Expenses and owner involvement
Build an expense schedule that distinguishes fixed costs, variable costs, discretionary spending, and costs that will change after the acquisition. Include hosting, software, contractors, inventory, advertising, customer support, payment processing, professional services, and refunds.
Then document the owner’s weekly responsibilities. A business that appears profitable may depend on the founder handling sales, support, content, development, or partnerships without recording a market cost for that work. Ask what happens if those activities require paid replacement capacity after closing. Your forecast should include transition costs and a realistic operating workload.
3. Traffic, conversion, and channel quality
Request access to read-only analytics and search or advertising reports where appropriate. Review sessions, users, landing pages, geographic mix, device mix, referral sources, branded versus non-branded demand, and conversion events. Look for changes that align with the revenue pattern.
For search-led websites, inspect the pages generating traffic and revenue rather than relying on total visits. Check whether traffic is concentrated in a small number of pages, keywords, or search engines. For paid acquisition, review spend, attribution, conversion quality, and dependence on one campaign or platform.
Traffic is an asset only when it is relevant, durable, and transferable. A large audience with weak conversion or unclear attribution may be less valuable than a smaller audience with consistent commercial intent.
4. Customers, retention, and concentration
For SaaS and subscription businesses, track active customers, new customers, cancellations, upgrades, downgrades, average revenue per account, and cohort behavior. Reconcile customer counts with billing records and define each metric clearly. “Churn,” for example, may refer to logo churn, revenue churn, or a period-specific cancellation rate.
For marketplaces, newsletters, content products, or ecommerce businesses, examine repeat usage, list engagement, order frequency, refund behavior, and customer concentration. Ask whether key customers have contracts, whether those contracts transfer, and whether relationships depend on the seller personally.
5. Technology, access, and transferability
Create an inventory of every asset needed to operate the business: domains, repositories, hosting, databases, analytics, email systems, social accounts, advertising accounts, payment accounts, vendor accounts, licenses, automation tools, and documentation.
Ask who owns the code, designs, content, trademarks, domains, customer data, and third-party accounts. Review dependencies, security practices, backups, deployment procedures, technical debt, and single points of failure. If the product cannot be operated or modified without the seller’s personal knowledge, treat that as a transition risk.
6. Legal, compliance, and ownership checks
Confirm the seller has the right to transfer the assets being offered. Review incorporation or ownership records where relevant, contractor and employee agreements, intellectual property assignments, customer and vendor contracts, privacy documentation, terms of service, licenses, open-source obligations, disputes, and unresolved claims.
Do not assume that an account, domain, image, customer list, or piece of software transfers automatically. A lawyer can help identify issues that are outside a buyer’s technical or commercial review.
7. Seller questions and red flags
Ask direct, specific questions:
- What changed in the last six to twelve months, and why?
- Which metrics are estimates rather than source-record figures?
- What work does the owner perform each week?
- Which customers, suppliers, channels, or platforms are most important?
- What has been tried and failed?
- What would a buyer need to fix first?
- Why is the business being sold now?
Red flags include inconsistent reports, unexplained spikes, reluctance to provide reasonable evidence, revenue that cannot be reconciled, traffic with no commercial connection, undocumented intellectual property, heavy dependence on one account, and a business that only works through the seller’s personal relationships. One warning sign may be explainable; several unresolved signs should affect your price or stop the deal.
Cadence and checkpoints
Run due diligence in stages rather than requesting everything at once.
- Initial screen: Review the listing, business model, headline financials, traffic sources, owner workload, and obvious concentration risks. Reject deals that fail your basic criteria.
- Pre-offer review: Test the main revenue and traffic claims, identify missing documents, and create an initial valuation range.
- Offer and exclusivity period: Verify source records, customer and supplier dependencies, technology ownership, contracts, liabilities, and transfer requirements.
- Pre-closing check: Refresh the latest monthly figures, confirm there has been no material change, test account access, and finalize the asset schedule and transition plan.
- Post-closing review: Establish a baseline for revenue, traffic, customers, costs, uptime, support volume, and owner workload so you can distinguish inherited performance from your own changes.
Use a monthly review during the first few months after acquisition, then move to a monthly or quarterly cadence that fits the business. The right interval depends on sales volatility, customer contracts, platform risk, and how quickly a negative trend could affect cash flow.
How to interpret changes
A change is not automatically a problem. First ask whether it is seasonal, a reporting change, a deliberate experiment, a platform event, or a genuine shift in customer behavior. Then compare the change with related metrics.
- Revenue rises while customers fall: Investigate pricing, concentration, upgrades, and whether the increase is durable.
- Traffic rises while conversions fall: Review traffic quality, landing pages, attribution, and changes in the offer.
- Profit rises while owner hours increase: Recalculate the economics using a realistic replacement cost.
- Churn rises after a product change: Segment affected customers by plan, tenure, acquisition source, and use case.
- One channel becomes dominant: Stress-test the business against a loss or decline in that channel.
- Costs fall unexpectedly: Check whether a necessary tool, contractor, campaign, or maintenance activity was paused.
Keep a dated change log. Record the metric, period, size of the movement, likely cause, evidence, and planned response. This prevents isolated monthly results from driving an emotional decision and makes it easier to revise your forecast.
When to revisit
Revisit this checklist whenever a material fact changes—not only when the transaction is about to close. A new analytics report, a lost customer, a platform warning, a contract change, a product release, or a meaningful cost increase can alter the risk profile.
Before signing, refresh the most important evidence and ask the seller to explain any movement from the last verified period. After closing, schedule a monthly operating review and a more complete quarterly review. Use the monthly meeting to check cash flow, customers, traffic, conversion, costs, incidents, and open transition tasks. Use the quarterly review to reassess concentration, channel durability, technology risk, owner workload, and the original acquisition thesis.
For practical next steps, create three files: an evidence log, a normalized financial model, and a transition checklist. Link each major assumption in the model to supporting evidence, mark unresolved items clearly, and assign an owner and deadline to every transition task. If you are comparing opportunities on a business acquisition marketplace, use the same checklist for each listing so that your comparisons are consistent. If you are considering a broker or marketplace route, review the differences in website brokers versus marketplaces.
A disciplined review does not eliminate acquisition risk. It makes that risk visible, priced, and manageable—and gives you a reliable basis for deciding whether to buy, renegotiate, or walk away.
