🚀 PARTNER ALERT: Planning an exit or looking to acquire? We used Empire Flippers Marketplace to map this calculation matrix. Get a vetted business evaluation on day one.
Free Checklist Tool

The 50-Point Due Diligence Checklist for Online Business Acquisitions

Check off each item as you complete it. Track your progress across all five categories — financials, traffic, revenue, legal, and transition. Nothing gets missed.

50
Checklist items
5
Categories
Free
No signup needed
Interactive
Tracks progress
Overall progress
0 / 50 items complete
💰
1. Financial Verification
0 / 10 complete
▼
Obtain 24 months of monthly P&L statements from the seller — not a summary, the full detail
Request 24 months of business bank statements (all accounts) and verify deposits match the P&L revenue line
Export 24 months of payment processor data (Stripe, PayPal, Amazon, etc.) and reconcile against bank statements
Request 2–3 years of business tax returns and confirm revenue figures match P&L (allow for normal timing differences)
Identify all one-time revenue items and remove them from your SDE calculation (contest prizes, asset sales, PPP loans)
Review and validate seller add-backs — owner salary, personal vehicle, phone, travel — are they genuinely discretionary?
Check all liabilities and debt — accounts payable, deferred revenue, outstanding loans, vendor agreements with minimum commitments
Calculate your own SDE number from the raw data — do not rely solely on the seller's number
If inventory is included, obtain independent inventory valuation or conduct a physical/digital count
Review accounts receivable — are any amounts owed that will not transfer or are unlikely to be collected?
📈
2. Traffic & SEO
0 / 10 complete
▼
Get view-only access to Google Analytics 4 directly — do not accept screenshots or exported CSVs only
Get view access to Google Search Console — check for manual penalties, coverage errors, and algorithmic drops
Review 24-month organic traffic trend — is it stable, growing, or declining? Look for the exact date the listing went live
Analyze traffic source breakdown — what percentage is organic, direct, referral, social, paid? Flag over-dependence on any single channel
Check for unusual traffic spikes in the 3–6 months before the listing date — a common sign of artificial inflation
Run independent Ahrefs or Semrush analysis — compare organic keyword rankings and traffic estimates against GA4 data
Check keyword ranking stability — are the top 10 revenue-driving keywords holding their positions over the last 12 months?
Audit the backlink profile — check for large numbers of low-quality links, PBN patterns, or link schemes that could trigger a future penalty
Confirm there are no active Google manual actions in Search Console under Security & Manual Actions
Sample 20+ content pages for quality — thin content, AI-heavy posts, or low E-E-A-T content are algorithmic risk
💳
3. Revenue Verification
0 / 8 complete
▼
Export payment processor reports (Stripe, PayPal, Shopify Payments) and verify totals match P&L revenue
Verify affiliate income at the affiliate network level (Commission Junction, Impact, ShareASale) — request 12-month export
Verify display ad revenue at the platform (Mediavine, Raptive, AdThrive, Google AdSense) — confirm RPM and monthly totals
For SaaS: verify MRR and churn rate inside the payment processor or billing platform (Stripe, Paddle, Chargebee)
Check customer concentration — does any single customer or affiliate partner account for more than 20% of revenue?
Verify refund and return rates — are returns higher than industry norms and not reflected in the reported P&L?
Identify and understand seasonal revenue patterns — is the SDE you are paying for representative of the trailing 12 or a peak season?
Review 12-month revenue trend independently — is revenue growing, flat, or declining in the months before the listing date?
⚖️
4. Legal & Operations
▼
Confirm business entity ownership — verify the seller owns 100% of the entity or assets being sold
Have your attorney review all material contracts (supplier agreements, platform agreements, client contracts)
Confirm IP and trademark ownership — are all brand names, logos, and patents registered to the entity being sold?
Confirm there are no pending or threatened lawsuits — request seller's representation and warranties in the APA
Verify domain ownership via WHOIS and confirm clean transfer to your registrar account is possible
Confirm all social media accounts are transferable — some platforms prohibit account sales, requiring brand page transfer
Review all supplier and vendor agreements — confirm they are transferable and have no change-of-control clauses
Review all employee and contractor agreements — confirm non-solicitation clauses and that key people will stay post-close
Verify all software licenses and tool subscriptions are transferable (hosting, plugins, SaaS tools used in operations)
Negotiate a non-compete clause from the seller — minimum 2 years, same business category, same geographic market
Arrange escrow through Escrow.com or a deal attorney — never wire funds directly to a seller without escrow
Have attorney review the Asset Purchase Agreement — all assets listed, liability exclusions clear, reps and warranties complete
🔑
5. Transition & Handover
0 / 10 complete
▼
Confirm SOPs exist for all core business functions — content creation, customer service, technical maintenance, fulfillment
Schedule a minimum 4-week training period with the seller — at least 2 calls per week for the first month post-close
Build a complete access transfer list: hosting, domain, analytics, ad platforms, payment processors, email marketing, social media
Confirm hosting and technology stack transfer — domain registrar, hosting provider, CDN, database, all login credentials
Confirm all business email accounts will transfer — or plan migration to your Google Workspace or Microsoft 365
Verify Google Workspace or email hosting is in your name (or can be transferred) without disrupting customer communications
Confirm social media admin access transfer — Facebook Page, Instagram Business, Twitter, LinkedIn Company Page, TikTok
Verify customer support history is accessible — Zendesk, Freshdesk, Gmail archives, or equivalent, so you can see past issues
Confirm seller availability for 30–90 days post-closing for questions — define the scope in the APA transition services section
Document all key vendor, supplier, and partner relationships with contact info — especially any informal referral relationships
How to use this checklist

The due diligence process — phase by phase

Due diligence is not a series of questions you email to the seller. It is a structured verification process where you independently confirm everything the seller has told you — and discover what they have not. Most buyers who lose money on acquisitions skipped at least one category above.

Ready to start shopping? Read our guide to buying an online business or use the SBA loan calculator to see how much a deal will cost you monthly.

Get deal alerts with DD-ready listings

We flag which listings have 2+ years of verified history, clean financials, and SBA-ready documentation. You get them before they fill up.

7-day free trial. No credit card required.

Frequently asked questions

How long does due diligence take when buying an online business?
Most due diligence periods run 30–60 days from LOI signing. Financial verification takes 5–10 days, traffic and SEO audit takes 3–5 days, legal review takes 7–14 days, and operations review takes 5–10 days. Do them in parallel, not in sequence, to stay inside your due diligence window.
What is the most important thing to verify in due diligence?
Financial verification is the foundation. You must independently confirm that bank statements, payment processor exports, and the P&L all reconcile to the same numbers. Sellers can manipulate a P&L spreadsheet but not actual bank deposits and payment processor records. Get access to all three sources.
Do I need to hire an attorney for due diligence?
Yes, for any acquisition over $50K. A deal attorney reviews the asset purchase agreement, IP assignments, non-compete clause, and representations and warranties. Budget $3,000–$5,000 for legal fees on a sub-$500K deal. It is the most important money you will spend in the process.
What traffic red flags should I look for?
The biggest red flag is a traffic spike in the 3–6 months before the listing went live. This often indicates the seller bought links, ran an ad campaign to inflate traffic, or the growth is unsustainable. Also look for Google manual penalties in Search Console, thin content pages with high rankings, and over-dependence on a single keyword or source.
What should I check for in financial due diligence?
Verify 24 months of P&L against bank statements, payment processor exports, and tax returns. Identify any one-time revenue items and back them out of recurring SDE. Check that the seller's add-backs are legitimate. Verify all major expense items, including any debt or liabilities that transfer with the business.
Can I do due diligence myself without hiring anyone?
You can do traffic, SEO, and operations verification yourself using free tools (Google Analytics, Search Console, Ahrefs free tier). Financial verification and legal review require professionals — a CPA and a deal attorney. Never skip professional financial and legal review on any acquisition over $50K. The cost is 1–2% of the deal; the downside of skipping it is losing everything.
Due diligence on traffic and keywords: SEMrush lets you verify organic traffic claims, check keyword rankings, and spot penalty history before you sign an LOI.