Buying a website online can provide a faster route to operating an online business, but a polished listing is not the same as a verified opportunity. This due diligence checklist shows what to examine before making an offer, how to monitor the business during a transaction, and which checks to repeat after the transfer.
Overview
A website acquisition combines several purchases in one: a digital property, its traffic sources, operating processes, technology, customer relationships, and sometimes inventory or intellectual property. The asking price only makes sense when these parts work together and the underlying records support the seller’s claims.
Whether you use a website marketplace, a broker, or a direct negotiation, treat the listing as a starting point rather than a final source of truth. Your objective is to build a clear record of what is being sold, how the business earns money, what could interrupt performance, and what you will need to operate it after closing.
A useful review has three stages:
- Screening: Decide whether the opportunity fits your budget, skills, time, and risk tolerance.
- Due diligence: Verify traffic, revenue, expenses, ownership, technology, customers, and operational claims.
- Transfer planning: Confirm how accounts, files, contracts, passwords, data, and responsibilities will move to you.
Do not rely on a single month, one analytics screenshot, or a seller’s summary of performance. Look for patterns, supporting records, and explanations that remain consistent across systems. For broader marketplace considerations, review this comparison of marketplace fees, escrow, and transfer policies.
What to track
1. Traffic and audience quality
Request read-only access to the relevant analytics and webmaster tools where possible. Compare reported sessions, users, page views, conversions, and top landing pages with the figures shown in the listing. The exact metrics vary by business model, but the important question is whether the trend and source mix are credible.
Record traffic by channel, country, device, and important page. Pay particular attention to dependence on one search query, one platform, one referral partner, or a small group of pages. Ask whether any traffic is paid, syndicated, incentivized, or generated by campaigns that will not continue after the sale.
2. Revenue and expenses
Ask for financial records that match the business model, such as payment processor reports, invoices, affiliate statements, advertising dashboards, subscription records, or order exports. Reconcile these records with the revenue figures in the listing rather than accepting a manually prepared spreadsheet on its own.
Separate gross revenue from owner earnings. List recurring expenses, variable costs, refunds, chargebacks, payment fees, advertising spend, software subscriptions, contractors, hosting, taxes, inventory, and customer support. If the seller describes a profit figure, write down exactly which costs are included and which are excluded.
For an ecommerce business, examine average order value, repeat purchases, returns, fulfilment, supplier terms, stock levels, and margin by product. For a content site, examine advertising or affiliate concentration and the work required to maintain or update pages. For a SaaS business, review active customers, churn, support demand, infrastructure costs, and the difference between trial activity and paying accounts.
3. Analytics access and data continuity
Verify that the accounts you are reviewing belong to the business and can be transferred. A seller may show performance from a personal account, an agency account, or a platform profile that cannot easily change ownership. Clarify what will happen to historical data when administrator access changes.
Create a simple baseline before closing: traffic, leads, orders, revenue, conversion rate, active customers, support tickets, and major expenses. This baseline will help you distinguish a normal fluctuation from a transfer problem.
4. SEO and traffic risks
Review the site’s top pages, backlink profile, indexed content, redirect history, technical errors, and recent changes in traffic. Ask how content was produced, who owns the rights to it, and whether any pages depend on temporary promotional activity. Investigate sudden spikes or declines instead of treating them as ordinary seasonality.
Look for signs of concentrated risk: one keyword driving most organic visits, expired partnerships, aggressive link-building, copied content, doorway pages, or redirects that do not support the current business. Do not assume an aged domain or a large backlink count guarantees future performance. If the transaction includes a domain rather than a full operating site, the guides on new versus aged domains and aged-domain buying provide useful context.
5. Technology, ownership, and security
List the site’s platform, hosting account, domain registrar, plugins, themes, code repositories, databases, email systems, payment integrations, analytics tools, and third-party services. Confirm which licenses are transferable and which must be replaced. Check renewal dates and whether critical services are registered to the seller’s personal email.
Ask for a current backup, a description of deployment and recovery procedures, and a list of administrator accounts. Do not request or store passwords through casual messages. Plan for new credentials, multi-factor authentication, least-privilege access, and removal of the seller’s access after the agreed support period.
6. Operations and seller claims
Document the weekly tasks required to keep the business running: publishing, fulfilment, customer support, product updates, bookkeeping, supplier communication, moderation, technical maintenance, and marketing. Estimate the time, knowledge, and cost required for each task.
Ask the seller to demonstrate important workflows rather than describing them only in writing. Confirm the status of employees, contractors, suppliers, licences, trademarks, customer lists, social accounts, and contracts. Any claim that materially affects value should have a corresponding record or a clearly stated limitation.
Cadence and checkpoints
Due diligence is not a single event. Use a schedule so that new information is captured and important figures are not allowed to go stale.
- Initial screening: Review the last available performance period, business model, asking price, traffic mix, owner involvement, and obvious platform restrictions.
- Before an offer: Confirm the core revenue, expense, traffic, and ownership evidence. Record unanswered questions and make any offer conditional on satisfactory verification.
- During negotiation: Update the financial model with verified figures, identify excluded assets, and agree on what the purchase price includes.
- Before signing: Recheck recent performance, account ownership, inventory, customer obligations, domain status, and material changes since the first review.
- At closing: Use a written asset schedule and transfer checklist. Confirm receipt of files, account invitations, domains, documentation, contracts, and any agreed training.
- Thirty, sixty, and ninety days after transfer: Compare actual results with the pre-closing baseline, resolve access gaps, and document recurring tasks that were not obvious before acquisition.
- Monthly or quarterly afterward: Track traffic sources, revenue concentration, margins, customer retention, technical health, renewal costs, and the workload required to maintain performance.
Keep the checklist in a shared document with four columns: item, evidence received, status, and follow-up owner. Use statuses such as verified, partially verified, not applicable, and unresolved. This makes it harder for an important question to disappear into a long email thread.
How to interpret changes
Not every decline is a deal-breaker, and not every increase is evidence of strength. Interpret changes in context and ask what caused them.
A traffic decline may reflect seasonality, tracking changes, a lost ranking, a broken page, or reduced promotion. A revenue increase may come from a short campaign, a single unusually large order, a price change, or a temporary supply condition. Compare several periods and connect traffic to business outcomes such as qualified leads, orders, gross margin, or retained subscribers.
Concentration is often more useful than a headline total. If most revenue comes from one customer, product, affiliate, supplier, advertising account, or traffic channel, model what happens if that source weakens. Ask the seller for evidence that the relationship or channel will continue, but value the business based on what can reasonably transfer.
When records conflict, pause rather than averaging the numbers. Identify the definition behind each figure: gross or net revenue, booked or paid orders, sessions or users, active or paying customers, or profit before or after owner labour. A clean explanation may resolve the discrepancy; an unexplained discrepancy should affect your price, terms, or decision.
Use a conservative valuation approach. Start with verified earnings or another metric appropriate to the business, then adjust for owner workload, concentration, technology risk, growth durability, transfer complexity, and required investment. A website valuation calculator can organize assumptions, but it cannot replace document review. For domain-only value questions, see this domain valuation guide; a functioning online business requires a wider analysis.
When to revisit
Revisit this checklist whenever you are considering a new acquisition, but also set recurring reviews for businesses you already own. A monthly review is appropriate when traffic, advertising, inventory, or cash flow changes quickly. A quarterly review may be sufficient for a stable content site or mature service business.
Update the review sooner when a major traffic source changes, revenue falls outside the expected range, a key supplier or customer leaves, a platform changes its rules, a domain or software renewal approaches, a security incident occurs, or the seller’s post-closing support ends. Cross-border transactions deserve an additional review of currency, tax, identity, delivery of digital assets, and dispute procedures.
Before sending funds, confirm that the transaction uses a documented process and a suitable website acquisition checklist. Use a reputable marketplace escrow service or another agreed payment mechanism that clearly defines release conditions. Confirm the asset schedule, inspection period, transfer responsibilities, and remedy for missing or materially inaccurate information in writing. Safe payment for an online marketplace depends on process and documentation, not simply on trust.
Action plan: create your evidence tracker, request read-only access, reconcile the last several reporting periods, map every asset and recurring task, identify concentration risks, and write down the conditions that would make you walk away. Then revisit the same measures after the transfer. A disciplined review will not remove every risk, but it will make the risks visible before they become your operating problems.
