Online Business Due Diligence: The Complete 2026 Checklist

Most buyers do too little due diligence. They accept the broker's one-page summary, scan three months of revenue screenshots, and wire money based on an optimistic narrative someone else wrote. Six months later, they discover the traffic was bought, the email list is disengaged, or the contractor who wrote all the content has already left for a competitor.

Due diligence is the most important part of any acquisition — and the part most buyers rush through because they're excited about the deal. The counterintuitive truth: the more excited you are about a listing, the more thoroughly you need to audit it. Excitement is how sellers get you to skip the uncomfortable questions.

This guide covers the five categories of due diligence in detail: what to verify, how to verify it, and what the red flags actually look like in practice. Use the interactive checklist below to track your progress deal by deal.

Category 1: Financial due diligence

Financial DD is where most deals get won or lost. The goal isn't just to verify revenue — it's to understand the quality of the revenue, the accuracy of the profit calculation, and whether the trailing 12-month number actually represents what the business will earn after you buy it.

The 24-month P&L requirement

Always request 24 months of monthly P&L statements, not 12. The reason: trailing 12-month averages can hide a declining business that still looks healthy on paper. If a content site earned $8K/month for 18 months and has been at $4K/month for the last 6 months, the TTM average is still $7K — but the forward-looking reality is a $4K business. Requesting 24 months shows you the trend, not just the average.

Once you have the P&L, match every month to bank statements. Discrepancies between the two are the most common form of financial misrepresentation in online business sales. A seller who says revenue was $12,000 in March but whose bank shows $8,500 deposited in March has a problem they need to explain.

Understanding seller's discretionary earnings (SDE)

SDE — not revenue, not profit — is the number that determines valuation. SDE is calculated as: Net profit + owner salary + personal expenses run through the business + non-cash charges (depreciation, amortization). The problem is that sellers add back anything they can, and buyers need to verify each add-back is legitimate and genuinely non-recurring.

Common legitimate add-backs: owner's salary if you plan to manage it yourself, one-time legal or consulting fees, equipment purchases with no ongoing need. Illegitimate or questionable add-backs: ongoing SaaS tools that you'll still need, contractor costs that will need to be replaced, ad spend that was "temporarily paused" before listing.

Revenue concentration check

Request a revenue breakdown by source for the last 12 months. No single revenue source should exceed 60% of total revenue. For affiliate sites, this means verifying the split between Amazon Associates, other affiliate programs, and display ad networks. For SaaS, this means checking customer concentration — if one customer is 40% of MRR, losing them halves the business.

Also check for one-time revenue events that inflated the trailing average. A viral post, a JV deal, a product launch, or a PR hit can spike revenue for one month and make 12-month averages look better than the sustainable run rate. Ask specifically: "Were there any months in the last 24 where revenue was significantly above normal, and what caused it?"

Category 2: Traffic and SEO due diligence

For any content site, niche site, or SEO-dependent business, traffic quality is the single most important variable in the acquisition. Two sites with identical revenue can have completely different risk profiles based solely on how that traffic arrives. The seller's GA4 screenshots tell you almost nothing useful.

Direct analytics access is non-negotiable

Request read-only access to Google Analytics (GA4) and Google Search Console before you sign an LOI. Not screenshots, not a shared report — actual login access. GSC specifically is where you'll find manual penalties, keyword ranking patterns, and whether any reconsideration requests have been filed. A seller who refuses access is hiding something; it's that simple.

In Ahrefs or Semrush (which you run yourself on any domain without the seller's involvement), pull the 24-month organic traffic trend and the keyword distribution. You want to see thousands of keywords driving traffic, not hundreds. A site that ranks for 300 keywords is one core update away from losing 40% of its revenue. A site that ranks for 15,000 keywords has real topical authority that's much harder to disrupt.

What the traffic trend tells you

Cross-reference the organic traffic chart against Google algorithm update dates. The HCU hit in September 2023, with follow-on core updates in March 2024. Sites that showed traffic drops correlated with those dates haven't fully recovered in many cases — and the fact that they're being sold now, in 2026, is meaningful. Ask the seller directly: "How did your traffic behave around September 2023 and March 2024?" The answer tells you everything.

Also check for traffic spikes in the 3–6 months before listing. Some sellers publish a burst of content or buy traffic to inflate the trailing average before putting the site on market. The Wayback Machine can show you publishing cadence over time; a sudden burst of new pages in the last 6 months is a yellow flag worth investigating.

Category 3: Revenue verification

Revenue verification goes beyond the P&L. You need to confirm that the revenue shown on paper actually flowed through the payment processors, affiliate networks, and ad platforms — independently, at the source, not in screenshots.

For payment processor verification: Stripe and PayPal both allow read-only access for collaborators. Match disbursement reports month by month against the P&L. For Amazon FBA, request Amazon disbursement reports via Seller Central. For AdSense or Mediavine, request screen-share or read-only access to the ad network dashboard — not a PDF export, which can be edited.

For affiliate income verification: Request read-only access to the affiliate network portals — ShareASale, Impact, AWIN, or direct brand affiliate portals. This shows you clicks, conversions, and payout history independently. Verify that the commission rates shown match what you'll be paid as a new account owner — some programs have tiered rates that reset on transfer.

For SaaS subscription businesses: Request Stripe MRR export, churn rate over 12 months, and active subscriber count at close date vs. 12 months prior. Monthly churn above 3% means the business is losing customers faster than most acquisition models assume. Annual churn above 15% is a serious concern for any subscription business.

The customer concentration check belongs here too: for SaaS or subscription businesses, list the top 10 customers by revenue. If any single customer is over 25% of MRR, that's a concentration risk that should be priced into your offer or used as a deal condition (e.g., confirmation that they plan to renew).

Category 4: Legal and structural due diligence

Legal DD for online businesses is often simpler than buyers expect — but the items that matter really matter. Missing a legal issue post-close can invalidate the entire acquisition or expose you to inherited liability.

Asset purchase vs. stock purchase

Virtually all online business acquisitions are structured as asset purchases, not stock purchases. You're buying the domain, the content, the email list, the customer contracts, the social accounts, the IP — not the legal entity. This is important because it means you generally don't inherit the seller's historical liability. Confirm this in writing with your attorney before closing.

IP ownership chain

Verify the ownership chain of every major asset: Does the seller own the trademark (or has an application filed)? Does the seller own the domain (check Whois)? If content was written by freelancers, do their contracts include work-for-hire clauses that transfer copyright to the business? Many content sites have content that technically belongs to the freelancers who wrote it — a problem that becomes your problem post-acquisition.

Run the domain through the Lumen Database (lumendatabase.org) to check for DMCA takedown history. Repeat DMCA claims against a site can affect its Google indexing and reputation. Check USPTO TESS to understand the trademark situation on the brand name — whether it's trademarked, whether that trademark is transferable, and whether there are any conflicting claims.

Pending disputes and liabilities

Search PACER (the federal court database) for the seller's entity and any related LLCs. Search the Secretary of State records in their state of incorporation. This takes 30 minutes and has uncovered undisclosed lawsuits in more acquisitions than most buyers expect. Any pending litigation that touches the assets you're buying should stop the deal until resolved.

Category 5: Operational due diligence

Operational DD is where buyers most often underestimate the risk. The question isn't just "does the business work?" — it's "does it work without this specific seller running it?" The answer is frequently different from what the listing promises.

The key person dependency problem

Map every person who touches the business: the lead writer, the VA who handles customer emails, the developer who maintains the tech, the editor who approves content. For each one, ask: "Are they staying post-acquisition, and are they happy to?" This is a question brokers almost never ask for you. Do it yourself, directly, during the diligence period — and confirm it in writing as a condition of close.

The owner's time commitment is almost always understated. If a seller tells you "2–3 hours per week," ask for a 30-day time log. What actually shows up: 2 hours of "active" work and 8–15 hours of oversight, reviews, approvals, and responding to questions from contractors. Budget your post-acquisition time honestly or you will be unpleasantly surprised.

SOPs and documentation quality

Request all Standard Operating Procedures, editorial guidelines, and process documentation before close. A business with strong SOPs is worth more than a business without them — not because the price changes, but because your ramp-up time after acquisition drops from 3 months to 3 weeks. If there are no SOPs, price that into your offer as a discounted factor and budget 60 days of seller transition time instead of 30.

Evaluate the tech stack with the same lens. WordPress with 40 outdated plugins is a security risk and a maintenance burden. A SaaS built on deprecated framework versions means dev costs within 12 months. Hosting that's on the seller's personal account needs to be migrated — and migration has a non-zero failure rate. Build these transition risks into your timeline and your offer.

---

Common mistakes buyers make in DD

When to hire outside help

For acquisitions over $100K, the cost of professional DD help is almost always worth it. Here's what's typically available and what each costs:

The math is straightforward: on a $300K acquisition, spending $5,000 on proper DD is 1.7% of the deal price. Finding a single issue — a misrepresented traffic trend, a departing contractor, an undisclosed penalty — that causes you to walk away or reprice by $30K more than pays for itself. The buyers who skip professional help on large deals are optimizing on the wrong variable.

For the complete interactive tool including all 47 items, visit our full due diligence checklist page — it saves your progress and lets you export a PDF summary for each deal.