Buying an online business requires more than reviewing a listing and accepting the seller’s headline numbers. This website acquisition due diligence checklist gives you a repeatable process for verifying traffic, revenue, expenses, SEO, technology, ownership, customers, and operational risks before you commit capital. It is designed to be used throughout a deal, with monthly or quarterly checkpoints whenever new information changes the picture.
Overview
Due diligence is the process of testing whether an online business performs as represented and whether its assets can be transferred and operated after closing. The goal is not to eliminate every risk. It is to identify material risks early, quantify what you can, and reflect the remaining uncertainty in your offer, deal terms, transition plan, or decision not to proceed.
Start by creating a simple diligence workspace with separate folders or tabs for financials, traffic, customers, technology, legal ownership, and communications. Record the date of every report and the period it covers. A screenshot without a date, source, or explanation is weak evidence; a source connected to the underlying account and reconciled against other records is much more useful.
Ask the seller for read-only access where practical, or request exports that cover a sufficiently long period to reveal seasonality and unusual events. Compare the listing, seller interview, financial records, analytics, and customer data. Differences do not automatically indicate wrongdoing, but unexplained differences should remain open questions until resolved.
If you are comparing a broker with a marketplace, the process and level of support may differ. See Website Broker vs Marketplace: Which Is Better for Buying or Selling? for context before deciding how you want to source and evaluate a deal.
What to track
1. Revenue and cash collection
Verify each revenue stream separately rather than relying on a single total. Depending on the business, this may include subscriptions, one-time purchases, advertising, affiliate commissions, sponsorships, services, or licensing. Request transaction-level or platform-level evidence, then reconcile it to bank deposits, payment processor statements, invoices, and the profit-and-loss statement.
- Monthly gross revenue and net cash received
- Refunds, chargebacks, discounts, and unpaid invoices
- Recurring revenue, cancellations, upgrades, and downgrades
- Revenue by product, channel, customer, or partner
- Any owner income or personal transactions included in the accounts
Do not treat booked revenue as the same as collected cash. A business can look profitable while carrying delayed payments, unusual receivables, or costs that have not yet been paid. For a deeper process, review How to Verify Online Business Revenue Before Closing a Deal.
2. Expenses and normalized profit
List recurring expenses, one-time expenses, owner-specific costs, and costs that a buyer will need to add after the transfer. Check hosting, software, contractors, advertising, payment processing, fulfillment, support, taxes, insurance, and professional services where relevant. Ask which expenses are paid annually and whether any renewal is approaching.
Build your own normalized profit view. Remove expenses that truly will not continue, but add reasonable replacement costs for work currently performed by the seller. If the owner handles product development, customer support, sales, content updates, or technical maintenance, that responsibility has economic value even when no salary appears in the accounts.
3. Traffic and SEO
Review traffic by month, source, landing page, geography, device, and returning versus new visitors. Look for concentration in one search engine, page, keyword group, referral partner, social account, or campaign. Compare analytics data with Search Console or other first-party records where available, and investigate major gaps between platforms.
- Organic clicks, impressions, rankings, and indexed pages
- Direct, referral, paid, social, and email traffic
- Conversions and revenue by traffic source
- Recent algorithm, migration, redesign, or tracking changes
- Backlinks, expired domains, purchased links, or other tactics that may create risk
Traffic is not automatically an asset if it does not produce revenue or depends on a fragile source. Use the verification process in How to Verify Website Traffic Before You Buy: GA4, Search Console, and Third-Party Tools to structure this review.
4. Customers and retention
Understand who pays, why they buy, and how long they stay. For a subscription business, review customer count, churn, retention, failed payments, plan mix, and customer concentration. For a content or affiliate site, examine the relationship between audience activity, commercial intent, and monetization. For an ecommerce business, check repeat purchase behavior, returns, inventory exposure, and supplier dependence.
Request anonymized customer data when personal information cannot be shared during diligence. Identify the largest customers and partners, the terms governing those relationships, and whether any account depends heavily on the current owner’s personal involvement.
5. Technology, accounts, and ownership
Inventory every asset required to operate the business: domain names, code repositories, hosting, databases, analytics properties, email accounts, payment processors, advertising accounts, social profiles, trademarks, design files, documentation, and third-party integrations. Confirm that the seller owns or can legally transfer each item.
Review the technology stack for security, maintainability, licensing, and single points of failure. Ask about recent incidents, backups, uptime problems, undocumented scripts, hard-coded credentials, and dependencies on personal accounts. A technically simple site can still carry transfer risk if nobody has documented how it works.
6. Legal, contractual, and operational risks
Ask about disputes, threatened claims, intellectual property ownership, privacy obligations, platform warnings, advertising restrictions, supplier contracts, employment or contractor arrangements, and customer commitments. Confirm whether content, software, images, trademarks, and data were created by the seller or acquired with transferable rights.
Document the operating workload in practical terms: hours per week, recurring tasks, response times, publishing schedule, development backlog, and the people who perform each task. A business that appears passive may require substantial hidden labor.
Cadence and checkpoints
Use a staged review rather than requesting everything at the last minute.
- Initial screen: Check the listing, stated revenue, traffic trend, business model, asking price, and obvious concentration risks. Reject deals that fail your basic requirements before spending significant time.
- Pre-offer review: Request enough financial and traffic evidence to form a reasoned valuation range. Separate verified figures from seller estimates and assumptions.
- Post-offer diligence: Reconcile source records, inspect technology and ownership, review contracts, and test the transition plan. Keep a written list of open items and assign each one an owner and deadline.
- Pre-closing check: Refresh the most recent month’s revenue, traffic, customer, and expense data. Confirm that no material account, contract, or business condition has changed since the offer.
- Transition checkpoint: Confirm that domains, hosting, email, payments, analytics, code, and documentation have transferred and work as expected. The Website Transfer Checklist After Closing can help organize this handoff.
For an active acquisition pipeline, review open diligence items weekly while a deal is moving. After closing, review core operating metrics monthly and complete a more detailed business review quarterly. A first-90-days dashboard can be organized using Best Metrics to Track in the First 90 Days After an Acquisition.
How to interpret changes
One month rarely tells the whole story. Look for direction, magnitude, duration, and cause. A traffic decline may reflect seasonality, a tracking error, a ranking change, or a genuine loss of demand. A revenue increase may come from a temporary promotion, a single large customer, delayed invoices, or a durable improvement in conversion.
Use a variance log with five fields: metric, expected result, actual result, likely cause, and next action. Reconcile material changes to primary records and ask the seller for contemporaneous evidence rather than accepting a retrospective explanation without support.
Pay particular attention to changes that affect the buyer’s forecast:
- Revenue or traffic becoming more concentrated in one source
- Declining conversion despite stable visitor numbers
- Rising refunds, churn, support volume, or fulfillment costs
- Loss of a key customer, supplier, ranking, partner, or employee
- New technical, legal, platform, or account-access restrictions
When a risk cannot be resolved, convert it into a decision. You might lower the offer, use an earnout or holdback where appropriate, require a transition commitment, add a representation to the agreement, or walk away. Do not let an attractive headline multiple replace a clear view of downside exposure.
When to revisit
Revisit this website due diligence checklist whenever the deal changes or the evidence becomes stale. At minimum, refresh the review monthly during a prolonged negotiation and immediately after any material event, such as a sharp traffic movement, major customer loss, product outage, account warning, ranking change, ownership dispute, or unexpected expense.
Before signing, compare current results with the figures used in your offer. If the latest period differs materially, pause and re-underwrite the deal rather than treating the change as an administrative detail. After closing, keep the same checklist as a quarterly operating review. Track the metrics that supported your acquisition thesis and compare actual performance with the assumptions in your model.
Your next practical step is to create a diligence tracker with one row for every important claim or asset. Add the source, date checked, status, risk level, and required action. Close only the items that are verified, clearly documented, or deliberately addressed in the agreement. Then use the first 90 days after transfer to test whether the business performs as expected and to identify the easiest improvements, as outlined in Post-Acquisition Quick Wins.
