Buying an online business is a high‑stakes game. Miss one red flag and you could lose thousands. This guide gives you a battle‑tested, 50‑question checklist to protect your investment and boost your odds of success.
Deal Alert AI is reader-supported. We earn commissions from affiliate links at no cost to you.
This post is based on a video from our Deal Alert AI YouTube channel. Watch the original or read the full breakdown below.
Online businesses are attractive because they’re often cash‑flow positive, scalable, and location‑independent. But that same attractiveness draws sellers who may overstate metrics or hide liabilities. Due diligence is the systematic process of verifying every claim the seller makes, from revenue numbers to intellectual property ownership.
Think of due diligence as a medical exam for a potential acquisition. A doctor doesn’t prescribe surgery based on a single symptom; they run labs, imaging, and a physical exam. Similarly, you need financial statements, traffic analytics, legal documents, and operational SOPs before signing a purchase agreement.
When done right, due diligence does three things: it uncovers hidden risks, validates the seller’s price, and gives you leverage in negotiations. Miss it, and you could inherit a site that’s been penalized by Google, a SaaS product with an expiring license, or a revenue stream that evaporates once the founder leaves.
We scan Empire Flippers, Flippa, Acquire.com and Quiet Light daily — scoring every listing. Start free.
The financials are the foundation of any acquisition. Start with the profit and loss (P&L) statements for the last 12‑24 months. Look for consistency in revenue, gross margin, and net profit. A sudden spike in earnings could be a one‑off event, like a seasonal promotion, rather than sustainable growth.
Scrutinize the revenue breakdown. Is the income coming from diversified sources—ads, subscriptions, affiliate commissions, product sales—or is it overly reliant on a single client or platform? For example, a SaaS business that gets 80% of its recurring revenue from one enterprise client is vulnerable if that contract ends.
Don’t forget cash flow. A business may show $100k net profit on paper, but if $70k of that is tied up in unpaid invoices or pending refunds, the real cash you can deploy is far lower. Request bank statements, Stripe or PayPal reports, and reconcile them with the seller’s reported numbers.
Traffic is the lifeblood of most online businesses. Request Google Analytics, Search Console, and any third‑party ad platform dashboards. Verify that the visitor numbers, bounce rate, and average session duration match the seller’s claims.
Look for traffic sources. Organic search is generally the most stable, but it can be volatile after algorithm updates. Paid traffic is predictable if you have the budget, but it adds ongoing expense. Referral traffic from a single influencer can evaporate if that partnership ends.
Check the quality of the audience. A site with 100,000 visitors a month but a 0.5% conversion rate may be less valuable than a niche blog with 10,000 highly engaged readers converting at 5%. Use metrics like Cost Per Acquisition (CPA) and Lifetime Value (LTV) to gauge profitability.
Understanding the day‑to‑day operations is critical. Ask for SOPs (Standard Operating Procedures), employee contracts, and any automation scripts. If the business runs on a handful of manual processes, you’ll need to budget for hiring or training.
Technical health includes website architecture, hosting, and security. Request access to the code repository (GitHub, Bitbucket) and check for outdated libraries or security vulnerabilities. For SaaS products, verify that the codebase is maintainable and that there are no hidden licensing fees.
Don’t overlook third‑party dependencies. A dropshipping store that relies on a single supplier in China is at risk if that supplier goes out of business. Similarly, a WordPress site using a premium plugin that’s about to lose support could require costly redevelopment.
Legal due diligence protects you from lawsuits and regulatory penalties. Verify ownership of all intellectual property—domain names, trademarks, copyrights, and any proprietary software. Use WHOIS lookup to confirm the domain is not about to expire.
Review contracts with affiliates, advertisers, and service providers. Look for termination clauses, exclusivity clauses, and any revenue‑share obligations that could affect future cash flow. For example, a content site that pays a 30% revenue share to a former founder may see profit margins shrink after acquisition.
Compliance is especially important for businesses handling personal data. Ensure GDPR, CCPA, and other privacy regulations are being followed. Ask for a copy of the privacy policy, data processing agreements, and any recent audit reports.
Armed with due‑diligence findings, you can negotiate from a position of strength. If you uncover a $30k expense that the seller omitted, you can request a price reduction or an earn‑out clause tied to future performance.
Deal structures vary: cash, seller financing, earn‑outs, or a combination. An earn‑out protects you if the seller’s projections are optimistic; it ties part of the purchase price to hitting post‑closing milestones. For example, a $150k acquisition might include $100k upfront and $50k payable if revenue exceeds $250k in the next 12 months.
Don’t forget tax implications. In the U.S., an asset purchase can provide depreciation benefits, while a stock purchase may have different capital gains treatment. Consult a tax professional early to avoid surprises.
Below is a distilled, numbered checklist that captures the most critical questions from our full 50‑question due‑diligence framework. Use it as a quick reference during your next acquisition.
These 20 questions represent the high‑impact items that typically surface the biggest risks. The full 50‑question list expands on each category, diving deeper into niche specifics such as email list hygiene, API rate limits, and international tax obligations.
Step 1 – Initial Screening: Use platforms like Flippa or Empire Flippers to identify listings that meet your investment criteria (price range, niche, growth potential). Filter out any that lack basic financial transparency.
Step 2 – Request Documentation: Send a concise data‑room request covering the 50‑question checklist. A professional data‑room (Google Drive, Dropbox, or a dedicated VDR) signals seriousness and speeds up the process.
Step 3 – Deep Dive Analysis: Allocate at least
We scan Empire Flippers, Acquire, Flippa, and Quiet Light daily. The best sub-$500K businesses are gone within 48 hours.