Website Due Diligence Checklist: How to Evaluate an Online Business Before You Buy

Overview

A listing can provide a useful starting point, but it is not a substitute for evidence. Your job as a buyer is to connect the seller’s claims to underlying records, identify dependencies that may not transfer, and understand whether the business fits your skills, budget, and available time.

Use this checklist in stages rather than requesting every document immediately. Start with a quick screen, move to structured diligence once the opportunity appears viable, and reserve final verification for the period immediately before closing. You can also use the more detailed website acquisition due diligence checklist as a companion during document review.

Keep a written diligence log with four columns: claim, evidence, open question, and decision. This prevents attractive growth stories from overshadowing unresolved risks. It also gives you a clear basis for changing your offer, adding deal protections, or walking away.

Checklist by scenario

For an initial screening

• Business model: Identify exactly how the business earns money, who pays, what is being transferred, and whether revenue is recurring, transactional, advertising-based, affiliate-based, or mixed.
• Basic economics: Compare reported revenue, direct costs, operating expenses, and seller-discretionary earnings over a meaningful period. Look for trends rather than relying on one strong month.
• Traffic sources: Record the share of visits from search, direct, referrals, social, email, paid acquisition, and other channels. A business dependent on one source deserves deeper testing.
• Owner workload: Ask what the owner does each week, which tasks are documented, and which activities depend on personal relationships or specialized knowledge.
• Transferability: Confirm that the domain, code, content, customer data, brand assets, social accounts, analytics properties, supplier relationships, and relevant contracts can be transferred.
• Reason for sale: Treat the explanation as context, not proof. A reasonable reason for selling does not remove the need to verify performance.

For traffic and SEO diligence

• Request read-only access to the primary analytics platform and search reporting tools, where practical. Compare reported sessions, users, conversions, and revenue with the seller’s summary.
• Review traffic by month, geography, device, landing page, channel, and new versus returning users. Investigate sudden spikes, unexplained declines, and unusual concentrations.
• Compare organic clicks and impressions with analytics visits. Differences can be normal, but large unexplained gaps require clarification.
• Inspect the most valuable pages and queries. Determine whether performance depends on a small number of pages, one topic, one country, or a temporary trend.
• Check backlink sources, content ownership, redirect history, indexing issues, manual actions, and prior SEO work. Ask for an explanation of any large historical traffic changes.
• Review technical basics such as domain registration, hosting, CMS access, backups, plugins, tracking scripts, page templates, and update procedures.

For a practical process, see how to verify website traffic before you buy. The goal is not to demand a particular traffic profile; it is to understand how durable and controllable the current profile may be.

For revenue and customer diligence

• Reconcile revenue in the profit-and-loss statement with payment processor, bank, subscription, advertising, affiliate, or marketplace records.
• Separate gross receipts from net revenue. Account for refunds, chargebacks, payment fees, taxes, affiliate commissions, hosting, software, and fulfillment costs.
• Analyze revenue by month, product, customer, channel, and geography. Identify the percentage generated by the largest customers or partners.
• For subscriptions, review new customers, cancellations, failed payments, upgrades, downgrades, and retained revenue over time.
• For content or media assets, examine advertiser or affiliate concentration, commercial intent, list quality, publishing dependencies, and the durability of top-performing pages.
• Confirm that customer relationships, consent records, contracts, support history, and relevant data can legally and operationally move to the buyer.

Use this revenue verification guide to structure the financial portion of diligence. If the seller cannot provide reasonable evidence, treat the uncertainty as a valuation issue rather than filling the gap with optimistic assumptions.

For technical and operational diligence

• Map every system required to operate the business, including domain registrar, hosting, code repository, databases, email, customer support, payments, analytics, advertising, and integrations.
• Confirm who owns each account and whether access uses a personal email, shared credentials, or an organization-controlled identity.
• Review deployment procedures, backups, error monitoring, security practices, licenses, open-source dependencies, and known technical debt.
• List recurring tasks by frequency and estimated time. Include publishing, support, sales, billing, technical maintenance, reporting, and compliance work.
• Identify contractors, employees, suppliers, or partners whose continued involvement is necessary. Confirm assignment terms and transition expectations.
• Ask for standard operating procedures and a realistic handover plan. A business that works only through the seller’s memory carries additional transition risk.

What to double-check before making an offer

Several issues are easy to overlook because they sit between commercial, technical, and operational diligence.

• Assets included in the price: Write down whether the transaction includes the domain, content, code, trademarks, customer lists, social accounts, email list, inventory, contracts, and any related domains.
• Historical changes: Ask about redesigns, migrations, algorithm-related traffic changes, pricing changes, product launches, disputes, and outages. A recent improvement may not yet be proven, while a recent decline may not be fully visible in annual figures.
• Concentration: Measure dependence on one customer, traffic source, affiliate partner, advertising platform, supplier, employee, or founder relationship.
• Legal and rights position: Confirm ownership of code, images, written content, trademarks, customer data, and third-party materials. Ask about disputes, takedown notices, privacy obligations, and contractual restrictions.
• Working capital and liabilities: Clarify unpaid bills, refunds, credits, taxes, prepaid services, subscriptions, inventory, and obligations that could follow the business after closing.
• Transition support: Define the length and scope of seller support, response expectations, introductions, documentation, and any training included in the agreement.
• Deal mechanics: Decide how funds will be held, what conditions must be met before release, and how disputed assets or incomplete transfers will be handled. An organized website transfer checklist can reduce avoidable closing problems.

Common mistakes buyers make

1. Relying on screenshots: Screenshots can be edited, incomplete, or difficult to interpret. Prefer direct access, exported records, and reconciled statements.
2. Using averages that hide volatility: A twelve-month average can conceal a recent decline, a seasonal peak, or a one-time contract. Review monthly data and explain material movements.
3. Valuing revenue instead of transferable profit: Revenue without its acquisition costs, delivery workload, refunds, and infrastructure expenses does not show what the buyer will actually receive.
4. Ignoring the owner’s role: If the seller handles sales, content, support, partnerships, or technical work personally, price the business based on the cost and difficulty of replacing that contribution.
5. Assuming traffic equals demand: High traffic may have weak commercial intent, low conversion, or heavy dependence on a volatile channel. Connect traffic to qualified leads, customers, and cash collected.
6. Skipping a transfer rehearsal: Discovering after closing that a domain, payment account, email system, or code repository cannot be moved can disrupt operations and weaken your negotiating position.
7. Letting urgency replace judgment: A deadline or competing interest should not eliminate basic verification. If evidence is incomplete, use a revised offer, conditions, escrow structure, or a pause.

When to revisit this checklist

Use the checklist at three points: when screening a listing, before signing a definitive agreement, and immediately before closing. Recheck the underlying numbers if the transaction takes long enough for another reporting period to pass or if a major event changes traffic, revenue, staffing, pricing, or platform access.

It is also worth revisiting before seasonal planning cycles and whenever the business changes its tools or workflows. A new analytics setup, payment processor, CMS, email platform, traffic channel, or contractor can change both the evidence available and the risks you need to assess.

For a practical next step, create a folder with the listing, financial records, analytics exports, access map, contracts, technical inventory, and open questions. Mark each item as verified, partially verified, or unresolved. Then make your decision using three outputs: a base-case forecast, a downside case for the largest identified risks, and a list of deal terms that would protect you if those risks materialize. After closing, track the first 90 days against the assumptions you made during diligence; the first-90-day metrics guide can help turn that review into an operating routine.