The 30-Day Due Diligence Checklist for Buying an Online Business
Deal Alert AI is reader-supported. We earn commissions from affiliate links at no cost to you.
Most online business acquisitions follow a 30-day due diligence window between signed Letter of Intent and closing. That window feels long until you're inside it — and then it feels impossibly short. Buyers who enter due diligence without a structured process spend the first week overwhelmed, the second week chasing documents they should have already received, and the third week second-guessing decisions they should have resolved in week one.
This guide breaks the 30-day due diligence process into four weekly phases, each with clear objectives and a specific checklist. Whether you're buying a content site, SaaS product, eCommerce store, Amazon FBA brand, or agency, this framework applies. Where business model specifics matter, I've noted them inline.
The goal of due diligence is not to find reasons to walk away. It's to verify the claims made in the listing and understand what you're actually buying — including the risks, the dependencies, and the gaps between the current owner's operation and what it could become under yours.
Before Due Diligence Starts: What to Have Ready
Due diligence is a two-way street. Sellers and brokers evaluate buyers during this process just as buyers evaluate the business. Arriving unprepared signals to the seller that you're a tire-kicker, and on competitive deals, that's enough for a motivated seller to accept a competing offer.
Before signing the LOI and entering due diligence, you should have ready: proof of funds or a pre-approval letter for the full purchase price, a clear operating plan for what you'll do in the first 90 days, any relevant industry or operational experience that supports your ability to run this type of business, and a list of your advisors — attorney, accountant, possibly an industry-specific consultant.
You should also have a clear walk-away number in mind before emotional investment deepens. The purpose of due diligence is to confirm or contradict the thesis that drove you to make the offer. If due diligence reveals that thesis was wrong, you need to be able to walk away — even at deal 50 when you've been searching for 18 months.
Financial Verification
Week one is entirely about the money. Don't get distracted by operations, traffic, or team dynamics until you've confirmed the business generates what the seller claims it generates. Everything else is secondary to this.
- Request 24 months of bank statements. Reconcile monthly deposits against reported revenue for every month. Look for gaps, seasonal patterns, and any months where reported revenue doesn't match deposits.
- Verify all revenue sources. Connect each revenue line in the P&L to a specific platform: Stripe, PayPal, Amazon Seller Central, Shopify Payments, Gumroad, etc. Request transaction-level exports, not summaries.
- Rebuild the P&L independently. Take the seller's P&L and reconstruct it using the underlying documents. Every line item should be verifiable against a bank statement, invoice, or platform export.
- Calculate true Seller Discretionary Earnings (SDE). Start with net profit, add back the owner's compensation, add back discretionary expenses (personal travel, non-essential subscriptions), subtract the cost of a manager to replace the owner. This is the real earning power.
- Identify all costs not on the P&L. Ask specifically: what would a new owner need to spend that you don't currently? Common omissions include owner labor priced at zero, software trials that end, and relationships that depend on the seller personally.
- Verify accounts receivable and payable status. Any outstanding invoices or unpaid bills at close transfer to the buyer unless specifically excluded. Know what's outstanding.
- Request tax returns for the past 2 years. The P&L should roughly match the tax returns. Large discrepancies between reported revenue and tax filings are a serious red flag.
Traffic, Product, and Operations Verification
With financials verified (or the deal stopped if they didn't pass), week two focuses on the operational engine: where does revenue actually come from, and how stable is it?
- Get Google Analytics 4 or equivalent access. Request read-only access to the analytics platform. Verify total sessions, traffic sources, geographic breakdown, and conversion rates for the past 24 months.
- Identify the top 3 traffic sources by revenue contribution. If one source drives more than 50% of revenue, that's concentration risk. If it's Google organic, assess the keyword ranking stability. If it's paid, understand the economics and whether they survive ownership transfer.
- Run a full backlink audit (content sites and SaaS). Use Ahrefs or Semrush. Look for toxic links, link velocity spikes that could indicate manipulation, and whether the traffic aligns with the link profile.
- Interview 3–5 current customers. This is underutilized and extremely valuable. Ask why they chose this product, what they'd do if it went away, and what they wish were different. You'll learn more in 30 minutes of customer calls than in a week of document review.
- Assess key person dependency. What specifically would break if the current owner were completely removed on day one? Map every process that depends on the seller's relationships, knowledge, or presence. These are transition risks that need explicit mitigation plans.
- Review supplier and vendor contracts (eCommerce and FBA). Identify which agreements transfer automatically and which require renegotiation or consent. Get verbal or written confirmation from top suppliers that they'll continue with new ownership.
- Evaluate the tech stack and infrastructure costs. What software runs the business? What are the costs? Are there any technical debts — outdated code, security vulnerabilities, platform migration risks — that will require capital to address?
Get AI-Scored Deal Alerts Before Anyone Else
Deal Alert AI monitors Empire Flippers, Quiet Light, Flippa, and Acquire.com. Get notified when a qualifying listing hits the market.
Get Free Alerts →Legal, Intellectual Property, and Risk Assessment
Week three is where your attorney earns their fee. Don't do this phase without legal representation. The cost of a proper acquisition attorney for a $200K-$1M deal is $2,000-$8,000. That fee has saved buyers from multiples of that in undisclosed liabilities more times than you'd believe.
- Confirm what exactly is being sold. Asset sale versus stock sale has major implications. Most online business acquisitions are asset sales (you buy the assets, not the legal entity). Confirm this explicitly and understand what assets are and aren't included.
- Verify trademark and domain ownership. The business's brand, domain, and any registered trademarks should be clearly owned by the seller with no encumbrances. Request USPTO records for any trademark filings.
- Review any existing contracts and their assignability. Affiliate agreements, software licenses, partnership contracts, vendor agreements — which ones can be assigned to you at close and which require third-party consent?
- Search for any pending litigation or legal claims. Request a legal representation letter from the seller's attorney confirming no pending claims. Search the seller's name and business name in public court records.
- Review privacy policy and data handling compliance. Particularly for SaaS and content businesses with email lists: does the business comply with GDPR, CAN-SPAM, and applicable data protection laws? What data transfers with the business and under what conditions?
- Assess platform terms of service risk. For businesses dependent on Google, Amazon, Apple App Store, or any major platform — review the platform's terms of service for anything that could constitute a violation. Platform bans are the most common form of catastrophic business failure in online acquisitions.
- Structure the representations and warranties. Work with your attorney to ensure the purchase agreement includes seller reps and warranties covering revenue accuracy, undisclosed liabilities, IP ownership, and account good standing. These give you legal recourse if something surfaces post-close that was misrepresented.
Transition Planning and Closing Preparation
Week four is about getting ready to operate. The deal isn't done at close — it's done when you've successfully transitioned operations and the revenue is stable. Most of that work starts now, before you own the business.
- Build a 90-day operating plan. Week by week, what will you do? Who will you hire or replace? What will you change and what will you leave alone? Sellers are more comfortable closing when the buyer has a credible transition plan.
- Schedule a minimum 5 hours of seller training. Get this committed in the purchase agreement, not just verbally. Training should cover: every system the business uses, every relationship that matters, any tribal knowledge that isn't documented, and the top 3 risks the seller would watch if they were staying on.
- Finalize financing and confirm funds availability. Whether SBA loan, seller financing, personal capital, or a combination — confirm that all funds will be available for wire on the closing date. Delays here cost deals.
- Review and negotiate the final purchase agreement. Every acquisition needs a proper purchase agreement drafted by an attorney. Read every line. Pay particular attention to: purchase price adjustments, inventory valuation method, working capital targets, earnout provisions if any, and escrow holdbacks.
- Complete all platform account transfer steps. For each platform the business operates on — email list provider, payment processor, hosting, analytics, social accounts, Amazon Seller Central — document exactly what needs to happen at close and in what order.
- Set up your business entity and banking. You'll need a business entity to receive the business and a bank account for operations. Do this before close so day-one revenue can flow correctly.
- Conduct a final pre-close revenue verification. In the last 48 hours before closing, verify that revenue is still flowing at the levels you underwrote the deal on. Request a screenshot of the last 30 days from each revenue platform. Confirm nothing has changed.
Red Flags That Should Stop the Deal
Due diligence reveals different things on different deals. Some findings are manageable — they change the price or the deal structure but don't kill the transaction. Others are deal-killers. Know the difference before you go in.
Hard stops — walk away immediately: Revenue that cannot be verified against bank statements. A platform account with active policy violations or pending suspension. Litigation that isn't disclosed voluntarily. A customer concentration where one buyer represents more than 30% of revenue and that relationship is personal to the seller. Trademark or domain ownership disputes.
Negotiating points — renegotiate or restructure: Revenue trending down but explainable by a specific, fixable cause. Key employee or contractor who may not stay. Supplier relationship that needs renegotiation at better terms. One traffic source that's concentrated but growing. Deferred technical work that can be quantified.
The difference matters because buyers who treat negotiating points as deal-killers miss good businesses. Buyers who treat hard stops as negotiating points make expensive mistakes.
The Master Due Diligence Checklist: 30 Items in 30 Days
- Day 1: Request 24 months of bank statements and all platform revenue exports
- Day 2: Reconcile reported revenue against bank deposits for every month
- Day 3: Rebuild P&L independently from source documents
- Day 4: Calculate true SDE with all add-backs and subtractions
- Day 5: Identify all off-P&L costs new owner would incur
- Day 6: Request 2 years of tax returns and reconcile against P&L
- Day 7: Verify accounts receivable and payable status
- Day 8: Get Google Analytics read-only access and verify traffic sources
- Day 9: Identify revenue concentration by source and by customer
- Day 10: Complete full backlink and SEO audit (content/SaaS)
- Day 11: Interview 3–5 current customers
- Day 12: Map every task currently performed by the owner
- Day 13: Review all supplier and vendor contracts
- Day 14: Audit full tech stack and infrastructure costs
- Day 15: Confirm asset sale vs. stock sale structure
- Day 16: Verify trademark and domain ownership
- Day 17: Review all contracts for assignability
- Day 18: Search for pending litigation or legal claims
- Day 19: Review data privacy and compliance status
- Day 20: Assess platform terms of service compliance
- Day 21: Structure reps and warranties with attorney
- Day 22: Build written 90-day operating plan
- Day 23: Schedule and outline seller training sessions
- Day 24: Confirm financing availability and wire readiness
- Day 25: Negotiate final purchase agreement terms
- Day 26: Document all platform account transfer steps
- Day 27: Set up business entity and operating bank account
- Day 28: Final review of all open issues and resolution status
- Day 29: Pre-close revenue verification — last 30 days screenshot
- Day 30: Wire funds and close
Deal Alert AI Finds the Deals Worth This Much Work
Get notified the moment a qualifying listing hits Empire Flippers, Quiet Light, Flippa, or Acquire.com — AI-scored for financial quality and deal risk.
Start Free →Where to Find Online Businesses Worth Buying
Empire Flippers — Pre-vetted listings with financials verified before listing. Largest marketplace for serious buyers.
Acquire.com — Direct-from-founder listings, particularly strong for SaaS and tech products.