Most buyers get burned not because they skipped due diligence, but because they checked the wrong things. This checklist covers every area that matters — in the order it matters.
Browse Live DealsDeal Alert AI is reader-supported. We earn commissions from affiliate links at no cost to you.
Due diligence is what separates a calculated acquisition from an expensive mistake. The fundamentals — reviewing financial statements, confirming traffic sources, checking the legal structure — are well documented. But the deals that go sideways rarely fail on the basics. They fail because the buyer didn't understand how the business actually generates revenue, where its single points of failure are, or what happens when the seller steps away.
This checklist covers all the standard areas plus the less-obvious ones that experienced buyers have learned from painful first deals. It's organized in the sequence that makes the most sense: start with financials to confirm the deal is worth pursuing at all, then dig into traffic, technology, legal, and finally the operational handover details that determine whether you can actually run what you buy.
Financial due diligence is the most critical phase because it determines whether the asking price is justified and whether the business can support your acquisition financing. Nothing else matters if the financials don't hold up.
Never accept the seller's stated revenue without independent verification. Request read-only access to the payment processor account (Stripe, PayPal, Paddle, or equivalent) and verify that the revenue shown matches what the listing claims. Check the trailing 12 months month by month — not just the annual total. A business with $100,000 annual revenue could be growing from $5,000/month to $12,000/month or declining from $12,000/month to $5,000/month. Both aggregate to the same annual number with dramatically different acquisition implications.
If the business uses multiple revenue streams (ads, affiliates, subscriptions, product sales), verify each one independently. Affiliate revenue is confirmed through affiliate network dashboards. Ad revenue through Google AdSense, Mediavine, or Ezoic account access. Subscription revenue through the billing platform's historical reports. Don't let the seller combine them into a single spreadsheet figure without showing you the underlying source data.
Request a detailed profit and loss statement for the trailing 24 months. Then separately request the payment processor statements, bank statements (redacted for personal transactions but showing business expenses), and any SaaS or tool subscription invoices. Verify that the expenses listed in the P&L match the actual outflows you can see in the statements. Common expense manipulations: excluding the seller's time as an owner-operator (which must be added back at market rate), excluding contractor costs that aren't recurring but will become recurring under new ownership, and including one-time expenses that inflated costs in the comparison period to make current margins look better.
Seller Discretionary Earnings (SDE) is the standard profit metric for small online businesses. It equals net profit plus owner salary plus owner perks plus one-time expenses plus non-cash charges (depreciation, amortization). Verify the seller's SDE calculation by building it yourself from the source documents. Sellers frequently add back expenses that shouldn't be added back (recurring necessary costs) or fail to add back their own time when they should. If the seller is not adding back their own labor because "the business runs itself," ask how many hours per week they spend and what equivalent labor would cost at market rates. Most online businesses require 10–40 hours per week of owner time — that labor has real value and the multiple should reflect it.
Understand exactly which trailing period the seller is using to calculate the multiple. A listing priced at "40x monthly SDE" could be using last month's SDE, the trailing 3-month average, the trailing 6-month average, or the trailing 12-month average. These often produce dramatically different multiples. Always recalculate the multiple using the trailing 12-month average SDE as your baseline. If the trailing 12-month multiple is significantly higher than the stated multiple, the business has been growing and the seller is pricing for future performance — negotiate accordingly.
Revenue follows traffic, and traffic can disappear overnight. Understanding where the business gets its traffic and how stable those sources are is as important as understanding the revenue itself.
Request read access to Google Analytics and Google Search Console for at least the trailing 24 months. Verify that the traffic numbers match what the listing claims. Look for sudden spikes or drops that the seller hasn't explained — these often indicate viral content (temporary, not repeatable), algorithmic changes (a past penalty or recovery), or traffic manipulation. In GSC, check the search queries driving organic traffic and whether they're concentrated in a handful of keywords. Over-concentration in one or two queries creates vulnerability; if those rankings drop, revenue drops with them.
Break down traffic by source: organic search, direct, social, referral, email, paid. A business where 90% of traffic is organic search has Google algorithm risk. A business where 70% is direct or email has an owned audience — more stable, more valuable. Understand what would happen to revenue if any single traffic source dropped by 50% overnight. If the answer is catastrophic, the business is more fragile than its revenue history suggests.
For content or e-commerce businesses with significant organic traffic, run an independent SEO audit. Check domain rating (Ahrefs or Moz), referring domain count and quality, anchor text distribution, and historical ranking changes. Use the Wayback Machine to check whether the site has ever had a very different look or content mix that might indicate past penalty recovery. Check for manual actions in GSC. If the site has recovered from a past penalty, it may be more susceptible to future algorithm changes in the same category.
If the business has an email list, verify its size and health independently. Request an export from the email platform (Mailchimp, ConvertKit, ActiveCampaign) showing subscriber count, open rates, and click rates for the trailing 6 months. Industry average open rates run 20–35% for engaged lists — anything significantly below that suggests list decay, low-quality subscribers, or deliverability issues. Check whether the list was acquired through organic signup or purchased/aggregated — purchased lists are almost always low-quality and often create spam complaints.
Technology risk is underestimated by first-time buyers and overestimated by sellers. The real risks aren't in the tech stack — they're in the dependencies, the maintainability, and what breaks when the seller leaves.
Identify where the site is hosted and confirm access transfer is possible. For businesses on shared hosting or managed WordPress platforms (WP Engine, Kinsta, SiteGround), transfer is usually straightforward. For businesses with custom infrastructure (AWS, GCP, DO), understand what DevOps knowledge is required to maintain it and whether you have that knowledge or budget to hire it. Check uptime history — request data from the hosting provider or look at third-party monitoring services (UptimeRobot) if the seller has been tracking it. A site with 99% uptime loses roughly 7 hours per month to downtime. That matters for e-commerce businesses far more than content sites.
List every third-party tool the business depends on: payment processors, email providers, analytics platforms, affiliate networks, API providers, and content delivery networks. For each one, understand: is the account in the seller's name or the business's name, can it be transferred, and what happens to the service if the account name changes? Some affiliate programs require reapplication under new ownership. Some payment processor accounts have trust scores that don't transfer. Some SaaS tools have contract terms that prohibit transfer without approval.
If the business has a custom codebase (SaaS product, web app, or heavily customized site), request access to review it before closing. Look for: documentation (or its absence), test coverage, dependency freshness (outdated packages with known vulnerabilities), and hardcoded credentials or secrets. A codebase with no documentation, no tests, and five-year-old dependencies is a maintenance liability that may require significant investment to stabilize. Factor that into your offer.
Confirm the domain registrar and ownership history. Look up the domain's WHOIS history (DomainTools) to verify there are no surprises in ownership or registration. Check SSL certificate expiration and confirm the business has processes to renew it. Verify that all redirect chains are clean — broken redirects that the seller "just lives with" become your problem post-closing.
Legal due diligence catches issues that aren't visible in revenue charts or traffic data but can create liability after closing.
Confirm the legal entity structure. Is this an asset sale or an entity sale? In an asset sale, you buy the business's assets (domain, content, customer list, code, brand) and leave behind any liabilities attached to the entity. In an entity sale, you buy the legal entity itself, inheriting all its history — including any liabilities you don't know about. Asset sales are strongly preferred for online business acquisitions under $2 million. Entity sales make more sense at higher valuations where the entity itself has value (established banking relationships, government contracts, existing IP filings).
Confirm who owns the content, code, brand, and trademarks. If the seller used contractors to create content or code, verify that proper IP assignment agreements were in place. Contractor-created work is not automatically owned by the business — in the US, absent a written assignment agreement, copyright typically stays with the creator. A content site where a freelance writer retained copyright to high-traffic articles is a real legal risk that's worth catching before closing.
Request copies of all material contracts: affiliate agreements, vendor contracts, customer agreements (particularly for SaaS businesses), employment contracts, and any licensing arrangements. Identify which contracts include change-of-control provisions or require consent to assignment. Affiliate network agreements often require notification of ownership change. SaaS customer contracts may have assignment restrictions. Missing this can mean losing your most valuable revenue relationships post-closing.
For businesses with US customers: GDPR and CCPA data handling requirements. For businesses with email lists: CAN-SPAM and CASL compliance. For affiliate businesses: FTC disclosure requirements. For e-commerce: sales tax nexus and collection compliance. For businesses in regulated industries (health, finance, legal): specific FTC guidance and disclaimers. A business that has been operating without proper disclosures or data handling practices isn't necessarily disqualified — but you need to understand the exposure and plan for remediation.
Operational due diligence answers the most practical question of any acquisition: can you actually run this business after the seller leaves?
Ask the seller to document exactly how they spend their time each week, broken down by task and hours. Don't accept "it only takes 5 hours a week" without the detail. Common underestimates: content production time (if the seller writes their own content), customer support volume (especially for SaaS), contractor management overhead (communication, quality control, payment), and platform maintenance (dealing with algorithm changes, technical issues, tool updates).
Request written SOPs for every recurring task. If the seller doesn't have documented SOPs, that's a red flag — it means the business runs on tacit knowledge in the seller's head, not on documented processes that can be transferred. Negotiate for the seller to create SOPs as part of the pre-closing process, or budget for your own documentation time post-closing. Businesses without SOPs carry significantly more transition risk than those with documented operational playbooks.
If the business has employees or contractors, interview them as part of due diligence (with seller consent). Understand their roles, how they're paid, whether they work exclusively for this business, and critically, whether they intend to continue under new ownership. Contractors who work primarily because of their relationship with the seller may not stay. Key people risk is a significant factor in content businesses where individual writers produce the high-performing work, and in service businesses where operators build direct client relationships.
Negotiate the transition period before closing, not after. Standard terms: 30–90 days of seller availability post-closing, a defined number of hours per week, specific deliverables (introductions, knowledge transfer sessions, access handover), and a schedule that reduces seller involvement gradually rather than ending abruptly at day 30. For more complex businesses, negotiate a consulting arrangement at a defined rate for the 6–12 months following closing. This gives you continued access to the seller's expertise while you build your own operational knowledge.
Due diligence rarely produces a clean result. Most businesses have at least one issue that needs addressing — undocumented contractor work, an affiliate agreement with a notification requirement, higher-than-stated time requirements, or a traffic source more concentrated than listed. The question isn't whether to walk away from any imperfect business. It's how to adjust the deal to reflect what you've found.
When you find an issue: document it factually, quantify the financial impact where possible, and bring it to the seller in writing. "We've found that the business requires approximately 25 hours per week of owner time, not the 10 stated in the listing. We're adjusting our offer to reflect an additional labor cost of $2,500 per month during our stabilization period." That's professional, factual, and grounded in real data — exactly the kind of renegotiation that holds up and doesn't damage the seller relationship.
Some issues are deal-breakers regardless of price: pending litigation that could wipe out the business value, key revenue relationships that legally can't survive the ownership change, a codebase so compromised that it would require a full rebuild. Know your limits before you start. A business trading at a discount for reasons you can fix is an opportunity. A business trading at a discount for reasons that can't be fixed is just cheap — and cheap is different from a good deal.
Find businesses worth putting this framework to use on at dealalertai.com — the platform tracks live listings from Empire Flippers, Acquire.com, FE International, and Quiet Light with real-time alerts.