Buying a website or online business is not only a valuation exercise; it is an evidence review. This website acquisition due diligence playbook gives you a repeatable workflow for checking traffic, revenue, expenses, technology, legal rights, operations, and transfer conditions before you commit funds. Use the checklist for each prospective acquisition, record the evidence behind every conclusion, and revisit the process whenever platform rules, payment systems, or the business itself changes.
Overview
Due diligence should answer three questions: what is being sold, whether the reported performance is reliable, and what could change after ownership transfers. A polished listing can help you discover an opportunity, but it should not replace independent verification.
Start by defining the proposed transaction. Identify the legal entity or individual seller, the included domains, websites, applications, social accounts, customer lists, content, intellectual property, contracts, inventory, and other digital assets. Also record what is excluded. Ambiguity at this stage can become a dispute later.
Organize your review into evidence folders or a shared document. For every important claim, record the source, date checked, person who supplied it, and any limitation. A simple status system works well:
- Verified: supported by direct, read-only access or independent documentation.
- Partially verified: plausible but dependent on incomplete records, samples, or seller explanations.
- Unverified: asserted in the listing or conversation without adequate evidence.
- Exception: a discrepancy, risk, or dependency requiring a price adjustment, contract protection, or decision to walk away.
Make your offer or letter of intent conditional on satisfactory due diligence. It should describe the transaction scope, proposed price or pricing method, timetable, confidentiality expectations, access to records, and the conditions required before closing. The document is not a substitute for a final purchase agreement, so obtain appropriate legal and tax advice for the transaction and jurisdiction.
What to track
1. Traffic and audience quality
Ask for direct, view-only access to the relevant analytics property rather than relying only on screenshots or exported summaries. Compare reported sessions, users, landing pages, channels, countries, devices, and conversion events over a meaningful period. In Google Analytics 4, confirm that the property, date range, filters, and attribution settings match the seller's report. In Google Search Console, review clicks, impressions, queries, pages, countries, indexing signals, and manual-action or security information where available.
Look for concentration and sudden changes. A business that depends on one page, one search query, one advertising account, or one traffic source may be more exposed than headline totals suggest. Separate branded traffic from non-branded discovery, and investigate unusual referral sources, unexplained spikes, bot-like patterns, or traffic that does not produce corresponding commercial activity.
2. Revenue, expenses, and cash collection
Reconcile revenue by month against payment processor records, invoices, bank statements, platform reports, and the business's accounting records. For subscription businesses, separate new sales, renewals, upgrades, downgrades, refunds, chargebacks, and cancellations. For ecommerce businesses, reconcile orders with gross sales, discounts, returns, taxes, shipping, payment fees, inventory costs, and owner withdrawals.
Track revenue, gross profit, operating expenses, seller discretionary expenses, recurring revenue where relevant, customer concentration, refund rate, and cash conversion. Do not treat revenue as profit. Ask which costs will remain after the sale and which depend on the seller's personal work or relationships. The online business valuation metrics reference can help structure this review without treating any single multiple as a guaranteed valuation.
3. Technical condition and security
Inventory the domain registrar, hosting account, content management system, code repository, databases, plugins, themes, APIs, payment integrations, email systems, analytics tags, and third-party subscriptions. Confirm who owns each account and whether access can be transferred.
Review software versions, license terms, backups, uptime records if available, deployment procedures, administrator accounts, and known vulnerabilities. Test the core customer journey: landing page, account creation, checkout, payment confirmation, email delivery, password reset, and refund process. For a SaaS acquisition, inspect infrastructure costs, tenant separation, authentication, data exports, error monitoring, and the process for responding to incidents.
Do not request or store passwords in a shared checklist. Use controlled invitations, separate user accounts, multi-factor authentication, and a documented access-removal plan. For transfer testing, use the domain and website transfer checklist to cover DNS, analytics, accounts, and post-handover checks.
4. Legal rights, content, and contracts
Confirm the seller has the right to transfer the domain, software, brand assets, written content, images, videos, customer data, and other material included in the deal. Request evidence for commissioned work, stock media licenses, open-source obligations, trademarks, patents where relevant, and contractor assignments. Review privacy notices, terms of service, consumer obligations, advertising disclosures, and any unresolved complaints or disputes.
List every material contract: hosting, software, suppliers, agencies, affiliates, developers, payment providers, fulfillment partners, and customers. Check renewal dates, termination rights, transfer or change-of-control clauses, minimum commitments, geographic restrictions, and dependencies on the seller's personal account. If customer or employee data is included, obtain jurisdiction-specific legal advice on the permitted transfer and required notices.
5. People, processes, and handover
Document the work required to operate the business each week and month. Include publishing, customer support, order handling, product updates, content production, reporting, bookkeeping, renewals, advertising, and incident response. Identify tasks performed only by the seller, undocumented knowledge, and relationships that may not transfer.
Request standard operating procedures, supplier contacts, content calendars, support macros, credentials-transfer instructions, and a realistic handover schedule. A business that appears passive may still require regular judgment and specialist knowledge.
Evidence log template
For each checkpoint, record: claim, evidence requested, date received, verification method, finding, risk level, required remedy, and owner. Keep original files unchanged and note when a report was generated. This makes later negotiation clearer and reduces reliance on memory.
Cadence and checkpoints
Use staged diligence rather than requesting every document on the first day.
- Before an offer: review the listing, ownership story, basic traffic, revenue trend, asset scope, and obvious concentration risks.
- After a conditional offer or LOI: request direct platform access, financial records, contracts, technical inventories, and legal documentation.
- Before signing the purchase agreement: resolve material discrepancies, agree on representations and warranties, define included assets, and confirm escrow instructions.
- At closing: verify that transfer-ready accounts, domains, files, data exports, and handover materials match the agreement. Use a reputable marketplace escrow and secure payment process rather than sending funds based solely on an email instruction.
- After handover: test DNS, email, analytics, checkout, subscriptions, backups, support channels, and administrator access. Record exceptions and complete any agreed transition tasks.
For recurring monitoring, review financial performance and critical access monthly during the first few months. Review traffic sources, rankings, conversion rates, customer concentration, software costs, renewals, and legal or platform notices at least quarterly. The exact cadence should reflect the business model, transaction terms, and operational risk.
How to interpret changes
A change is not automatically a warning, and a stable headline number is not proof of safety. Interpret each movement in context and seek an explanation supported by records.
If traffic falls while rankings and conversion rates remain stable, seasonality or tracking changes may be involved. If traffic is stable but revenue falls, investigate pricing, checkout failures, lead quality, refunds, sales capacity, or attribution. If revenue rises but cash collection does not, examine payment delays, receivables, refunds, and chargebacks. If expenses fall unusually close to the proposed sale, ask whether a necessary supplier, contractor, or marketing activity has been paused.
Pay particular attention to changes that affect transferability. A domain controlled through a personal account, a customer base tied to one marketplace profile, or software dependent on the seller's identity may require a different structure or a transition agreement. A discrepancy does not always end a deal, but it should lead to one of four actions: request more evidence, revise the valuation, add a contractual protection, or decline the purchase.
Do not average away a critical exception. A small business can be materially affected by one inaccessible domain, one unlicensed image library, one failed payment integration, or one customer representing a large share of revenue.
When to revisit
Revisit this playbook whenever you evaluate a new acquisition, before signing a binding agreement, immediately before closing, and after the first operational handover. For an active search, refresh your checklist at least quarterly. Update platform-specific instructions when Google Analytics, Search Console, Stripe, PayPal, hosting panels, registrars, or marketplace interfaces change. Recheck escrow providers, transfer procedures, and transaction fees before a new deal rather than relying on an old saved instruction.
Use a monthly or quarterly review to compare the latest evidence with the original diligence file. Record changes in traffic mix, revenue quality, expenses, subscriptions, domain ownership, technical dependencies, customer concentration, and team responsibilities. If the business has experienced a material product, platform, algorithm, legal, or payment change, restart the relevant diligence section instead of merely adding a note.
Your next practical step is to copy the evidence-log fields into a spreadsheet, create one row for every material claim, and assign an owner and deadline for each unresolved item. Do not mark the acquisition ready for closing until the asset list, performance records, access plan, payment route, contract protections, and handover tests agree with the purchase agreement. For related domain research, consult the website buying safety checklist and the domain name due diligence checklist so the website and its key domain are reviewed as one transaction.
