Website Due Diligence Checklist for Buyers: Revenue, Traffic, Ops, and Transfer Risks

Overview

This guide gives you a practical website acquisition checklist you can use on almost any online business. The goal is not to turn every buyer into an auditor. It is to help you ask the right questions in the right order, so you can quickly separate healthy businesses from listings that only look healthy on the surface.

A strong online business due diligence process usually covers four areas:

• Revenue: whether sales, subscriptions, ad income, affiliate payouts, or lead fees are real, consistent, and transferable.
• Traffic: whether visitors are high quality, diversified, and likely to continue after the sale.
• Operations: whether the business runs on documented systems or depends heavily on the current owner.
• Transfer risk: whether the domain, accounts, software, suppliers, and customer relationships can be handed over cleanly.

If you are still early in the process, pair this checklist with a valuation framework before you negotiate. Our guide to online business valuation multiples by business type is a useful companion when you need to connect risk findings to price.

Before you begin, ask for read-only or live-view access where possible rather than relying on screenshots. The safest evergreen approach, reflected across current due diligence best practices, is simple: prefer primary-source verification over seller summaries. Bank statements, processor dashboards, analytics access, CRM exports, registrar records, and ad platform data usually tell a clearer story than a polished memo.

A simple order of operations

1. Confirm the asset exists and the seller controls it.
2. Verify financial performance using source systems.
3. Check traffic quality and acquisition concentration.
4. Review operational dependence and technical liabilities.
5. Map every item that must transfer at closing.
6. Use findings to revise valuation, deal terms, or both.

Checklist by scenario

Use the core checklist first, then add the scenario-specific checks that match the business model. This keeps your buy website checklist focused instead of bloated.

Core checklist for almost any website purchase

• Identity and ownership
  • Confirm legal seller identity and matching ownership of the website or business entity.
  • Verify domain ownership at the registrar and check renewal dates, lock status, and account transfer steps.
  • Confirm who owns the codebase, content, creative assets, databases, email list, and social profiles.
  • Check whether any core assets are held in employee or contractor accounts.
• Financial verification
  • Request at least 12 months of monthly P&L detail, and more if the business is seasonal.
  • Match reported revenue to source systems such as Stripe, PayPal, affiliate dashboards, app stores, ad networks, or invoicing tools.
  • Separate recurring, one-time, promotional, and non-operating revenue.
  • Identify refunds, chargebacks, cancellations, discounts, and credits.
  • Normalize owner-specific or one-off expenses before discussing true earnings.
  • Check whether recent growth came from repeatable channels or short-term promotions.
• Traffic and audience
  • Review analytics directly, not only exported charts.
  • Compare users, sessions, pageviews, top landing pages, top geographies, device mix, and channel mix over time.
  • Look for traffic spikes that do not align with revenue or engagement.
  • Check branded versus non-branded traffic where relevant.
  • Assess concentration risk: one page, one keyword cluster, one source, or one country should not drive most of the business unless the price reflects that risk.
  • Review engagement signals such as time on site, return visitors, email opens, conversion rate, or lead quality.
• SEO and content risk
  • Audit top-ranking pages and understand why they rank.
  • Check backlink profile quality for signs of paid links, private blog networks, spam, or unnatural anchor concentration.
  • Identify thin, duplicate, outdated, or AI-generated content that may be vulnerable to future updates.
  • Review indexing health, crawlability, redirects, canonicals, and broken pages.
  • Check whether traffic depends on a small number of volatile search terms.
• Operations
  • Document every weekly and monthly task required to keep the business running.
  • List all tools, automations, contractors, suppliers, and logins.
  • Estimate owner time honestly: sales, support, fulfillment, content updates, technical maintenance, compliance, and bookkeeping.
  • Ask what breaks if the seller disappears for 30 days.
• Technical and security
  • Identify hosting setup, code repository access, plugins, integrations, and custom dependencies.
  • Check backup routines, uptime history, incident history, and recovery procedures.
  • Review admin accounts, user permissions, API keys, and exposure of sensitive data.
  • Note technical debt that may require immediate work after closing.
• Legal and policy
  • Review terms, privacy policy, data collection practices, and consent mechanisms.
  • Check trademarks, copyright ownership, licenses, and any known disputes.
  • Confirm whether the business uses third-party content, images, or software within license terms.
  • Flag regulated niches, platform restrictions, and ad policy dependencies.
• Transfer and closing
  • Create a transfer list covering domain, site files, database, hosting, analytics, payment processors, ad accounts, CRM, email platform, social accounts, and vendor logins.
  • Confirm which assets can be transferred and which must be recreated.
  • Plan the handoff window, training period, and post-close support.
  • Use escrow and milestone-based release where appropriate.

Content site checklist

For a content-driven business, the biggest risks are often traffic concentration, weak content defensibility, and unstable monetization.

• Verify the mix of ad revenue, affiliate income, sponsorships, and direct partnerships.
• Check whether affiliate revenue depends on one merchant or one program.
• Review the top pages generating most revenue, not just most traffic.
• Inspect content freshness and update cadence. A site may look passive but still require constant maintenance.
• Identify pages with legal or medical claims, product claims, or other sensitive topics that raise quality thresholds.
• Check whether rankings are built on original insight, proprietary data, strong brand demand, or just keyword targeting.

Ecommerce checklist

When you buy an ecommerce site, revenue verification is only half the job. Margin quality and operational complexity matter just as much.

• Match store revenue to payment processors and bank deposits.
• Review gross margin by product, SKU concentration, and return rates.
• Check inventory valuation method and confirm stock levels physically or through trusted systems.
• Review supplier contracts, lead times, MOQs, defect rates, and dependency on a single manufacturer.
• Check whether branded products are actually protectable or easy to copy.
• Verify shipping workflows, carrier costs, customer support volume, and platform dispute history.
• Separate paid acquisition performance from organic demand; temporary ad efficiency can distort value.

SaaS checklist

A SaaS acquisition marketplace listing may emphasize MRR, but buyers should test retention, product stability, and founder dependence before focusing on multiple.

• Verify MRR, ARR, churn, expansion, contractions, and delinquent accounts directly in billing systems.
• Check revenue concentration across customers and plans.
• Review active users, feature adoption, and product usage patterns, not just paid subscriptions.
• Assess support burden, bug backlog, uptime, and deployment process.
• Confirm ownership of source code, libraries, infrastructure accounts, and documentation.
• Identify founder-led sales, support, or engineering work that has not been systematized.

Lead generation or directory checklist

• Verify where leads come from and how they are attributed.
• Check call tracking, form submissions, spam rates, and buyer conversion quality.
• Review contracts with lead buyers, advertisers, or local partners.
• Assess whether demand is recurring or campaign-driven.
• Confirm compliance around user data collection and consent.

What to double-check

Some issues deserve a second pass because they commonly survive the first review. If you only have limited time, double-check these before moving toward a signed agreement.

1. Revenue that looks clean but is not durable

Ask whether recent performance is normal. A seller may show strong trailing months that benefited from a seasonal event, a one-time partnership, temporary ranking gains, or unusually light ad spend. This does not mean the business is weak. It means you should distinguish current run rate from repeatable run rate. If revenue depends on a promotion the new owner cannot replicate, price and terms should reflect that.

2. Traffic that is real but low quality

Not all traffic supports a healthy acquisition. Verify whether visitors convert, return, and fit the intended audience. A website can show large traffic numbers while producing little profit because the traffic is poorly matched, misattributed, or inflated by low-value sources. Compare traffic trends with revenue, conversions, and engagement. If these lines do not roughly move together over time, investigate why.

3. SEO strength that depends on unstable tactics

Many buyers know to check traffic levels. Fewer inspect how those rankings were earned. Review backlink patterns, top page quality, internal linking, redirect history, and content depth. If the business depends on thin pages, recycled content, or aggressive links, future performance may be less reliable than the seller expects. The safest interpretation is to discount any growth you cannot defend with a durable explanation.

4. Operations hidden inside the founder

One of the most common acquisition mistakes is underestimating key-person risk. Ask the seller to document recurring tasks and walk you through a typical month. Then ask a harder question: which decisions require their judgment, relationships, or reputation? Founder-led sales, supplier leverage, editorial instinct, or technical fixes can all be hard to replace. This is where holdbacks, transition periods, and training clauses can matter as much as headline price.

5. Transfer assumptions

Do not treat transfer as an admin step. For many deals, it is a risk category of its own. Double-check that analytics access can be handed over, ad accounts can be reassigned or recreated without losing historical insight, domains can move on schedule, and all critical logins are controlled by the seller. If the business relies on a platform account that cannot be transferred under platform rules, you need a workaround before closing, not after.

6. Valuation without context

Due diligence findings should change the deal structure, not just your confidence level. If you discover concentration risk, technical debt, supplier fragility, or weak documentation, translate that into revised assumptions. That may mean a lower multiple, a seller note, an earnout, or a longer transition period. Buyers who skip this step often overpay even when they spotted the risks correctly. For a baseline, compare your target against relevant ranges in our guide to valuation multiples by business type.

Common mistakes

This section highlights where buyers usually go wrong when using a website due diligence checklist.

• Relying on screenshots. Screenshots are useful for orientation, not verification. Ask for direct access or live screenshares tied to source accounts.
• Confusing revenue with earnings. Strong top-line numbers can hide weak margins, high support costs, heavy reinvestment, or unstable acquisition costs.
• Ignoring concentration risk. One affiliate program, one keyword cluster, one supplier, one customer, or one ad account can materially change risk.
• Skipping historical context. Twelve months may be enough for some assets, but seasonal businesses often need a longer view.
• Underestimating handoff friction. Sellers may assume that a clean business naturally transfers cleanly. In practice, missing credentials, mixed personal and business accounts, or undocumented processes can delay the deal.
• Treating every issue as a deal killer. Most businesses have flaws. The question is whether the problem is fixable, priceable, and visible before close.
• Moving to legal documents too late. Core assumptions about assets, exclusions, transition support, and payment protection should be aligned before final paperwork.

If you are still choosing where to source deals, it helps to understand how different listing environments shape the diligence burden. Marketplace quality, broker involvement, and seller verification standards vary widely. Our comparison of the best places to sell an online business can also help buyers understand the kinds of listings and seller processes they are likely to encounter.

When to revisit

This checklist should not be used once and forgotten. Revisit it whenever the inputs change, especially before you commit capital.

Revisit before major milestones

• Before submitting an LOI: confirm the headline numbers, ownership, and transfer feasibility.
• Before signing the APA or purchase agreement: update financials, validate no major traffic or revenue changes, and finalize the transfer list.
• Before closing: recheck key dashboards for recent drops, account issues, policy flags, or payment problems.
• During transition week: track every handoff item and test access immediately.

Revisit when workflows or tools change

Website businesses evolve quickly. Analytics platforms change, tracking implementations break, payment systems migrate, and platform rules shift. If your diligence process depends on a specific tool or export format, update your checklist when those systems change. The safest evergreen habit is to focus on the underlying evidence rather than a particular dashboard layout.

Revisit before seasonal planning cycles

If the business has strong seasonal swings, review the checklist ahead of peak periods. That is when weak inventory planning, support gaps, advertising dependence, or cash flow strain tend to show up most clearly. For content businesses, revisit before algorithm-sensitive periods or major content refresh cycles. For ecommerce, revisit ahead of inventory commitments and promotional seasons. For SaaS, revisit before renewals, pricing changes, or infrastructure migrations.

A practical next-step workflow

1. Create a copy of this checklist and mark each item as verified, partially verified, unverified, or not applicable.
2. Assign every red flag one of three labels: pricing issue, term issue, or deal-breaker.
3. Request evidence in batches so the seller is not overwhelmed and you can track gaps clearly.
4. Summarize findings in a one-page memo before negotiating final terms.
5. Build a transfer plan before funds are released, not after.

The best buyers do not try to remove all uncertainty. They try to price and manage it. A disciplined website due diligence checklist helps you do exactly that: verify what matters, challenge what seems too convenient, and enter the acquisition with clearer expectations about revenue, traffic, operations, and transfer risk.