30 Critical Questions to Ask Before Buying an Online Business

Deal Alert AI is reader-supported. We earn commissions from affiliate links at no cost to you.

This post is based on a video from our Deal Alert AI YouTube channel. Watch the original or read the full breakdown below.

Why Standard Questions Fail in Digital Acquisitions

When you start looking to acquire an online business, the emotional high of the hunt often clouds your judgment. You see a dashboard with growing revenue, a healthy profit margin, and a smooth transfer timeline, and you want to move fast. However, the reality of the digital asset market is that sellers are experts at curation. They show you the clean data, the successful campaigns, and the satisfied customers. They hide the buggy code, the declining ad account health, and the customer service backlog. Relying on generic questions like "Is the business profitable?" or "Do you have employees?" will not protect you. These questions allow for vague, non-committal answers that do not provide the forensic evidence you need to value the asset correctly. In the world of online business acquisitions, "due diligence" is not a checkbox; it is the entire strategy. If you skip the deep dive, you are buying a broken machine. We have seen buyers pay six months of net profit above market value because they failed to ask about the source of traffic. We have seen buyers lose entire businesses because they failed to ask about the legal ownership of the domain or the software stack. The difference between a good deal and a terrible deal is usually the information you uncover before you sign the contract. This information asymmetry is the leverage you have as the buyer, and you must use it aggressively. That is why at Deal Alert AI, we emphasize that due diligence is a skill, not just a process. It requires you to be uncomfortable. It requires you to ask questions that make the seller slightly defensive because they know there is an answer they cannot hide. In this guide, we are breaking down 30 specific, high-impact questions categorized by domain: Financials, Traffic, Operations, and Legal. These are not theoretical questions. They are the exact probes we use to pressure-test deals before we recommend them to our clients. If you can answer these questions with hard data, you are safe. If the seller hesitates, you have found your red flag.

Financial Forensics: Verifying the Numbers

Revenue and Profit Verification

The first thing you must do is attack the bottom line immediately. Do not look at the total revenue first; look at the EBITDA (Earnings Before Interest, Taxes, Depreciation, and Amortization) and the Net Profit. Ask for the last 24 months of tax returns and profit and loss statements. It is not enough to see the spreadsheet the seller created. You need to see the bank statements that match the spreadsheets. If you see discrepancies of more than 5% between the P&L and the bank deposits, stop. That is a sign of accounting manipulation. Next, you need to understand the customer acquisition cost (CAC) structure. Ask for a breakdown of marketing spend. Is the seller throwing money at Google Ads and driving out customers who cancel after one month? If the Life Time Value (LTV) to CAC ratio is below 3:1, the business model is fragile. Ask specifically: "What happens to the profit margin if we pause all paid advertising for 30 days?" If the answer is "it goes to zero," then you are buying a traffic ad, not a business. A sustainable online business should have a portion of recurring revenue or organic traffic that sustains the base operations even if marketing spend is cut.

Debt and Payroll Obligations

You must also interrogate the cash flow. Ask: "What are the current monthly debt obligations?" This includes business loans, credit card minimum payments, and any outstanding invoices to vendors. More importantly, ask about the "payroll" of the business. If the owner is paid a salary through the company, that expense must be normalized. If the seller pays themselves $10,000 a month plus dividends, you need to ensure the business can still operate profitably if that obligation is removed or changed. If the numbers only work if the founder continues to work 60 hours a week for free, that is not a buyable asset. That is a job. Finally, check for unpaid taxes or liabilities. Ask: "Are there any open tax audits or outstanding invoices to third-party tools?" It is common for online business owners to under-report state sales tax or fail to pay for SaaS subscriptions they want to move to their personal names. These hidden debts become your debts. If you are buying a Shopify store, for example, ensure all plugin subscriptions are accounted for. If a yearly contract for a $5,000 service is due three months after closing, that is a real cost that impacts your Year 1 ROI.

Traffic and Marketing Deep Dive

Traffic Source Composition

Once the money is verified, you move to the engine that drives it: traffic. Most beginners look at the total number of visitors. This is a mistake. You need to know the *source* of every single visitor. Ask for a 12-month breakdown of traffic sources: Organic, Paid Search, Paid Social, Email, Affiliate, Direct, and Referral. If 80% of your traffic comes from one single organic keyword, you are holding a house of cards. Google algorithm updates can wipe that out overnight. If 90% comes from a single Facebook ad account, and that account has been flagged or restricted, your business is at high risk. Diversification is the metric of stability. A healthy online business should have a mix of revenue channels. Ask: "What is the growth rate of each traffic channel separately?" If organic is growing 2% a month but paid is growing 20% a month, your business is becoming more dependent on increasing ad spend. This scales poorly because ads get more expensive over time. You want to see organic growth that compounds. You want to see an email list that is growing even if ad spend is flat. This is the hallmark of a true asset.

Organic vs. Paid Dynamics

For any site relying heavily on SEO, you must ask about the keyword map. Ask for the top 50 keywords driving revenue and their current rankings. Are they on page one? Page two? If they are on page two on a high-competition keyword, you are betting on a fluctuating effort. If they are owning a specific niche keyword, that is valuable. You should also ask about the backlink profile. Are links coming from authoritative domains, or is the seller buying cheap PBN (Private Blog Network) links? Cheap links are a liability. If Google cracks down on PBNs, your domain authority can drop by 50% in a week, taking your traffic with it. On the paid side, dig into the efficiency metrics. Ask for the ROAS (Return on Ad Spend) for the last six months, broken down by campaign. Do not look at aggregate ROAS; look at the best and worst performing campaigns. If 80% of the sales come from 20% of the ads, those ads are your lifeblood. Are those assets creative videos? Static images? If they are static images, they can be refreshed. If they are unique, creative hooks that the employee who wrote them just quit, you have lost the IP behind the ads. You need to know if the marketing strategy is replicable by a new person or if it relies on the seller's specific intuition.

Operational and Technical Health

Stack and Infrastructure

Now we look under the hood. What platform is the business built on? If it is a custom-coded site, who maintains it? Ask for the line of code inventory. If a freelancer built it and charges $2,000 a month for maintenance, that is a fixed cost you can negotiate or replace. If the seller wrote it themselves in a proprietary language no one else understands, you are trapped. You are the only one who can fix it. That is a terrible position to be in. For e-commerce, ask about the inventory management system. Is it integrated with your shipping provider? What are the return rates? A return rate of above 10% for non-clothing items is a sign of product description issues. A return rate of above 25% for clothing suggests sizing or quality problems. These operational leaks eat into margins significantly. You need to see a sample of the shipping discrepancies. If you spend 20% of your time chasing refunds, the "profitable" business is actually a customer service nightmare.

Employee Dependence and SOPs

If the business has employees, the key question is: "Who is the single point of failure?" In many small online businesses, one person does everything. They answer every email, they process every order, and they make every marketing decision. Ask: "If you were in a plane crash tomorrow, could this business continue to operate at 80% capacity for 30 days?" If the answer is no, you have bought a job, not a business. To test this, ask for a Standard Operating Procedure (SOP) manual. Look at the level of detail. "Send email to customer" is not an SOP. "Open Gmail, click drafts, use template #4, insert order ID, click send, log ticket in Helpscout" is an SOP. The more granular the documentation, the lower the risk. If the seller says, "We just do it by feel," walk away. You are buying an asset that requires you to teach the employees how to work, which will take months of lost revenue.

Legal, IP, and Platform Risk

Ownership and Contracts

In the digital world, "ownership" is complex. Do you own the domain? Who is the registrant? If the domain is registered to a personal email that is not part of the LLC, you will face huge friction during the transfer. Ask: "Do we own the email marketing platform?" If the business uses Mailchimp or ConvertKit, these accounts are tied to personal email addresses. If the seller uses their personal account, you will lose all historical customer data. You must demand the transfer of all digital assets, including domains, social media profiles, and app store accounts, before closing. Check the contracts with vendors. Are there change-of-control clauses? If you buy a website that relies on a white-label SaaS API, does the SaaS provider have the right to cancel the contract because the owner of the site changed? In 2021, we saw several deals fall through because a payment processor changed their terms regarding business entity transfers. You need to read the fine print of every third-party service the business uses. If you are buying a business on Flippa, the platform helps verify some of this, but you must still do your own legal due diligence. Never assume the platform's verification is enough for high-ticket items.

Industry and Platform Volatility

Ask about the platform risk. Is the business built exclusively on Facebook? If so, you are at the mercy of a company whose monetization strategy may change tomorrow. Meta has changed its visibility algorithms over 50 times in the last five years. Is the business built on Amazon? Amazon can ban your account with a single click and leave you with inventory you cannot sell. Is the business on Etsy? Etsy has raised fees significantly in the last two years, cutting into margins for many sellers. You need to ask: "What is our contingency plan if this platform restricts our account?" A resilient business has a backup channel. If you are an Amazon seller, do you have a direct-to-consumer store? If you are an App Store developer, do you have your own email list? If the answer is "we rely 100% on this one platform," you are taking on extreme concentration risk. Diversification is not just about traffic; it is about where the value resides.

The 30-Question Due Diligence Checklist

We have condensed our most effective probing questions into a list. Use this as your interview script. Do not skip any. Record the answers. If you feel the seller is evading, pause.

1. Provide the last 24 months of bank statements that match the P&L.
2. What is the exact EBITDA margin, excluding the owner's salary?
3. What is the CAC for the last 6 months, broken down by channel?
4. What is the LTV for a new customer?
5. What is the churn rate for subscribers/members?
6. What percentage of revenue comes from repeat customers?
7. Do all domains resolve to the correct IP and have DNS propagated?
8. Is the SSL certificate set to auto-renew, and who controls it?
9. Do you have the admin rights for the email marketing account?
10. What is the current age of the domain, and do you have historical WHOIS records?
11. Are there any pending litigation or lawsuits against the business?
12. What is the status of all vendor and supplier contracts?
13. Do you have a Service Level Agreement (SLA) with third-party tech vendors?
14. What is the inventory turnover rate for e-commerce?
15. What is the return rate, and what is the primary reason for returns?
16. Who currently handles customer support, and what is the average response time?
17. Is there an SOP document for every daily recurring task?
18. Are there any unpaid taxes or state-level compliance issues?
19. What is the dependency on the founder for high-level decisions?
20. What is the technical debt of the codebase (if custom)?
21. Can we access the code repository and test the build?
22. What is the uptime history for the past 12 months?
23. Are all app store or marketplace accounts in good standing?
24. Do you have the ability to change the pricing model without breaking contracts?
25. What is the competitive analysis, and what is our unique moat?
26. Are there exclusive rights to any content or IP?
27. Who owns the social media accounts, and can they be transferred?
28. What is the history of traffic spikes and dips over the last year?
29. Are there any dependencies on specific influencers or affiliates?
30. What is the forecast for the next 12 months, and what assumptions does it rely on?

Negotiation Leverage: Using Data to Win

Once you have the answers to these 30 questions, you move from being a passive buyer to an active negotiator. The goal of due diligence is not just to pass or fail the deal, but to find the "value leaks." Did you find that the return rate is 20% higher than the industry average? That is a $10,000 monthly impact on profit. That is your negotiation point. You do not say, "This is a bad business." You say, "The return rate is higher than expected, which caps our ability to scale. Therefore, we need to adjust the price to reflect the remediation cost." If the traffic is 90% paid, you have found a working capital issue. You will need more cash to keep the ads running while the business stabilizes. You can negotiate a lower initial payment and a higher earn-out based on ad account stability. If the code is buggy, you negotiate a credit for the development costs you will need to incur in Month 1. By the end of the due diligence process, you should have a list of 3 to 5 specific, quantifiable reasons to reduce the price or add seller protections (earn-outs, indemnification clauses). Sellers respect buyers who know the numbers. If you can quote their CAC, their churn rate, and their top three keywords, you signal that you are serious. This changes the dynamic. They stop trying to sell you a dream and start trying to close a sale. This is the position you want to be in. It prevents you from overpaying due to FOMO (Fear Of Missing Out) and ensures that you are buying a business that can actually sustain the price tag after you take over the wheel.

Final Thoughts: Protecting Your Capital

Buying an online business is one of the most efficient ways to build wealth, but it is not for the faint of heart. The risk is not that no one will buy the business; the risk is that you will buy a business that is broken, unstable, or illegal. The cost of a bad acquisition is not just the purchase price. It is the six to twelve months of your life spent trying to fix a fundamental flaw that was visible in the data all along. Use the questions above with discipline. Be relentless. Do not let the seller rush you. Take your time. If the data does not support the valuation, walk away. The market is always full of new deals. If you miss one, another will come in three weeks. But if you buy a broken business, you are stuck with it for months. Your capital is finite; your time is more precious. Protect both. At Deal Alert AI, we use these frameworks to curate the highest quality deals for our network. We believe that informed buyers win every time. By mastering the art of due diligence, you remove the emotion and the guesswork from the equation. You replace them with data, logic, and strategy. That is how you build a portfolio of profitable, sustainable, and scalable digital assets. Go out there, ask the hard questions, and buy like a professional.