Due Diligence
15 Online Business Due Diligence Red Flags That Should Kill the Deal
Most acquisitions that go wrong were predictable. The red flags existed before closing — buyers either didn't know what to look for, or convinced themselves the warning signs were manageable. After analyzing thousands of online business listings, these are the 15 signals that should stop the deal.
On the AI Deal Analyzer: Our AI is trained to extract these exact red flags from listing descriptions. When you paste a listing, it returns the specific signals it found and the questions to ask before you invest time in due diligence.
Red Flag 01
Traffic spike in the 3–6 months immediately before the listing
A sudden traffic increase right before a business is listed for sale is one of the most reliable signals of manipulation. Sellers know the listing price is based on trailing 12 months of earnings — a 3-month spike inflates the average and the asking price. Check Google Search Console data for the full 24-month trend. If traffic looks like a hockey stick that started exactly when they decided to sell, treat the spike as unsustainable and value on the 18-month average before it.
Red Flag 02
Revenue data available for 3–6 months only
Legitimate sellers can provide 24 months of financial data. When a seller offers only 3–6 months of P&L or analytics access, one of two things is true: the business is too new to have history (high risk), or the seller is hiding something in the older data. Always require 24 months as a non-negotiable condition of moving to LOI. Brokers like Empire Flippers verify this data independently — another reason to use vetted marketplaces.
Red Flag 03
Single customer or client over 40% of revenue
Customer concentration is the most common silent killer of online business acquisitions. If one client accounts for 40%+ of revenue and they leave within 12 months of your purchase (which happens more often than sellers predict — relationships are personal), you've overpaid for a business that's now worth 40% less. The rule: no single customer should represent more than 20% of revenue for any acquisition you consider at full market multiple. Above that threshold, demand meaningful price reduction.
Red Flag 04
Seller lists "owner time: 5 hours/week" but can't explain what those 5 hours involve
Every online business listing claims minimal owner time. Ask the seller to describe what they actually do in those 5 hours — in detail. If they can't answer specifically, the real time requirement is higher. If the answer involves constant firefighting, client management calls, or technical decisions that require deep expertise, you're buying a job that's been mislabeled. The right answer: "I do X on Monday, check Y on Wednesday, review Z reports on Friday." Vague answers are a red flag.
Red Flag 05
Google Search Console shows 6+ months of declining organic traffic
A content site or SaaS blog with 6+ months of declining GSC clicks isn't necessarily unsalvageable — but it changes the valuation dramatically. Buying at 32× monthly SDE when revenue is declining 5% month-over-month means you're paying 32× for earnings that will be significantly lower next year. Get the full GSC export and model the trajectory. If clicks are declining, the SDE multiple should reflect that risk — often meaning a 30–40% discount from asking price is justified.
Red Flag 06
80%+ of traffic or revenue from a single source
Platform dependency is existential risk. A content site where 85% of traffic is organic Google search is vulnerable to any algorithm update. An FBA business where 90% of revenue is from one ASIN on Amazon is vulnerable to competitor attacks, review manipulation, and Amazon policy changes. A SaaS that gets 80% of signups from one referral partner is vulnerable to that partner terminating the relationship. Concentration in any single traffic or revenue source should be priced aggressively or avoided entirely.
Red Flag 07
Seller wants to exclude specific revenue from the calculation
"That revenue is going away anyway so I didn't include it." "That was a one-time contract so I backed it out." Any time a seller excludes meaningful revenue from the SDE calculation with a reason you can't independently verify, scrutinize hard. Sometimes add-backs are legitimate. But sellers have strong financial incentive to maximize add-backs and minimize expenses. When you can't verify an exclusion independently, treat it as not real until proven otherwise.
Red Flag 08
History of niche pivots or rebrands in the past 24 months
A business that changed its niche, domain, or core product in the past 24 months carries significant risk. SEO authority accrued under one niche doesn't always transfer to another. Customer relationships built under one positioning don't automatically follow a rebrand. The 24-month P&L may include revenue from a business model that no longer exists. Always use the Wayback Machine to understand what the site was doing 1–2 years ago before buying on current metrics.
Screen listings for red flags automatically
Paste any listing description and the AI extracts the specific red flags from the text — before you request financials or schedule a seller call.
Red Flag 09
Screenshots instead of direct data access for revenue verification
Screenshots of Stripe, Google Analytics, or ad network dashboards can be edited. They prove nothing. Legitimate sellers will provide read-only access to payment processors, Google Analytics, and Google Search Console. If a seller refuses to provide direct access and insists screenshots are sufficient, either they don't trust you (address that) or the data doesn't match what's shown (walk away). Reputable brokers like Empire Flippers solve this by independently verifying financials before listing.
Red Flag 10
No documented systems, SOPs, or processes
If everything lives in the founder's head, the business doesn't transfer — it dissolves. For any acquisition, require a basic operations documentation handover: what happens each week, what tools are used, what the content or product creation process looks like, who the key vendors and contractors are. Businesses with no documentation are almost impossible to operate without the founder, which is the highest form of key-person risk.
Red Flag 11
Unusually low churn with no explanation
For SaaS businesses, if stated churn is below 0.5% monthly and you can't explain why (sticky workflow tool, multi-year contracts, deeply integrated product), verify it independently. Some sellers calculate churn on active logins rather than total paid customers. Others don't count customers who downgraded to free as "churned." Understand exactly how churn was calculated before trusting the number.
Red Flag 12
Key contractors unwilling to continue post-acquisition
Before closing on any business with contractors or employees, have honest conversations about their intentions. A writer who produces 60% of the content saying they'll "probably continue" is not reassurance enough. Get retention commitments in writing where possible, or build a transition plan that doesn't depend on specific individuals. The absence of employment contracts for key people is itself a red flag — it means the seller never locked in the people the business depends on.
Red Flag 13
Mismatch between stated revenue and lifestyle signals
This is subtle but real: a seller who claims $20K/month net profit but drives a $180K car paid for by the business has a strong incentive to inflate numbers. Cross-reference what the seller says with any lifestyle disclosures. More importantly, ask for tax returns — not just P&Ls. If reported income on tax returns is materially lower than stated SDE, you have a problem.
Red Flag 14
Backlink profile with large recent drops
Run any content site through Ahrefs or Semrush and look at the referring domain count over time. A significant drop in referring domains over the past 6 months often means Google has started devaluing a link profile that was previously propping up rankings. Devalued links = rankings will drop. Rankings drop = traffic drops. Traffic drops = SDE drops. Catch it before the traffic moves, not after.
Red Flag 15
Seller refuses to do a seller call before LOI
Any legitimate seller will do a 45-minute call before you submit a non-binding LOI. If a seller refuses — citing NDAs, time, or distrust — that information gap is yours to bear post-close. Use the call to ask direct questions: Why are you selling? What's the biggest risk in this business? What would you do differently? What do your best customers say they'd miss if the product disappeared? A seller who won't answer these questions directly is hiding something.
Free Checklist
47-Item Due Diligence Checklist
Don't buy until every box is checked.
What to do when you find red flags
Finding a red flag doesn't automatically mean walking away. It means pricing it correctly. A business with single-keyword concentration should trade at a 25–35% discount to a comparable diversified business. A business with declining traffic should be modeled on where traffic will be in 12 months, not where it is today.
The deals that create real returns for buyers are often the ones other buyers walked away from — for negotiable reasons. Learn to distinguish between structural problems (business model doesn't work) and fixable risks (needs SEO diversification, needs a content strategy update).
Use the free AI Deal Analyzer to flag these risks systematically on any listing before you invest significant time in due diligence.