Due Diligence Checklist Before Buying a Website or Online Store

Due diligence is the part of an acquisition where optimism meets evidence. A listing tells you what a seller wants you to believe; due diligence tells you what is actually true. For a website or online store, the goal is simple to state and demanding to execute: verify that the revenue is real, the traffic is genuine, the assets transfer cleanly, and no hidden liability comes attached. Buyers who treat this stage as a formality tend to discover the problems after the money is gone, when it is far too late to negotiate.

This checklist organizes diligence into five areas: financial, traffic, legal and compliance, technical, and operational. Work through them in order, document what you find, and treat any refusal to provide verification as a warning sign. The illustrative figures below are for teaching only; your conclusions must come from the specific business in front of you.

Financial Verification: Prove the Money Is Real

Everything else in the deal rests on the financials, so start here and be relentless. Do not accept a polished profit-and-loss spreadsheet at face value. Instead, ask the seller to screen-share the live source accounts: the payment processor, the advertising network dashboards, the bank account where deposits land, and the platform's own sales reports. Reconcile at least the last twelve months of these primary records against the stated profit, month by month.

Look for consistency and explanations. If one month spikes, find out why, and decide whether that spike is repeatable or a one-off. Rebuild the seller's discretionary earnings yourself, scrutinizing every add-back, because recurring costs disguised as one-time expenses inflate the apparent profit. As an illustrative example, if a seller claims $6,000 monthly profit but the payment processor shows an average of $4,500 in net deposits after refunds and fees, that $1,500 gap is exactly what you must resolve before proceeding. Financial figures also carry tax implications; for your specific situation, consult a qualified attorney or accountant.

Traffic and Marketing: Confirm the Audience Is Genuine

Revenue depends on traffic, so the quality and durability of that traffic is a core diligence question. Request direct, read-only access or a live walkthrough of the analytics rather than exported screenshots, which are easy to edit. Examine where visitors come from, how that mix has trended, and whether engagement metrics look like real human behavior or suspiciously uniform patterns that suggest purchased or bot traffic.

Concentration is the danger to watch for. A store that draws almost all its visitors from one search engine, one social platform or one advertising account is one algorithm change or account suspension away from collapse. Check the health of any paid advertising accounts, the standing of email and social channels, and whether marketing depends on the seller's personal accounts or relationships that will not transfer. Diversified, stable, verifiable traffic is worth far more than a large but fragile number.

• Live analytics access, not exported images
• Traffic-source mix and its trend over twelve or more months
• Evidence that engagement reflects real human visitors
• Concentration risk in any single channel
• Whether channels are tied to the seller's personal identity

Legal and Compliance: Check What You Are Inheriting

Confirm that the seller genuinely owns everything being sold and can legally transfer it. Verify domain registration and that the domain is free of disputes, check trademarks and any registered intellectual property, and review supplier and platform agreements for clauses that block transfer or change on sale. Ask directly about pending disputes, chargebacks, tax obligations and any past policy violations with platforms the business relies on.

Data protection deserves particular care. If the business holds customer, member or subscriber information, understand that such personal data is not a standalone asset you can simply buy. It may only transfer as part of the whole business or asset transfer, must continue to be used for its original purpose, and must comply with data-protection rules, including notifying data subjects and obtaining consent where the law requires it. Treating a customer or email list as a product to be sold on its own is both a compliance failure and a reputational risk. Laws vary by jurisdiction, so for your specific situation, consult a qualified attorney or accountant.

Technical Review: Inspect the Machine Under the Hood

A website is also a technical asset, and technical debt can quietly erode the value you paid for. Review the hosting arrangement, the platform or codebase, and how the site is maintained. For a custom-built site, assess code quality and whether it depends on a single developer no one can replace. For a store on a hosted platform, confirm the account, apps, integrations and payment gateways can all transfer to you.

Check practical health signals: site speed, mobile performance, security posture, and whether backups exist. Look at whether critical plugins, themes or third-party services are current and supported, since abandoned dependencies become future emergencies. Confirm that every login, API key and service account can be handed over, and that nothing essential is locked to the seller's personal email or phone number. A business that cannot be technically separated from its owner is not fully transferable.

Operational Diligence and Safe Closing

Finally, understand how the business actually runs day to day. Map the recurring tasks, the time they take, and which ones only the owner currently knows how to do. Review supplier reliability, fulfillment and inventory for stores, and any team members or contractors, including whether they will stay after the sale. The aim is to know exactly what you are taking on before, not after, you own it.

Close with structure rather than trust. Use an escrow service so funds release only when assets are verified as transferred, and put every included asset into a written asset purchase agreement. Transfer accounts methodically against a checklist, and negotiate a transition support window so the seller answers questions during the first weeks. Consider holding part of the payment until the handover is confirmed complete. Diligence does not end at signing; it ends when the business is fully in your hands and running as promised.

Thinking of buying or selling an online business? FlipWeb helps with valuation, NDAs, escrow and safe handover.