Due Diligence Checklist for Buying an Online Business

Due diligence is where a good deal is confirmed and a bad one is exposed. It's the process of verifying — with evidence — that the business is what the seller claims. Skip it and you're buying on trust; do it well and you buy with confidence or walk away wiser. Here's a practical checklist, grouped by what actually goes wrong.

Financial verification

Start with the money, because everything else is downstream of it. Don't accept summaries — verify from source:

• Bank and processor statements for 12–24 months, reconciled against the claimed revenue.
• Rebuilt owner earnings (SDE) — recompute profit yourself, scrutinizing which "add-backs" are legitimately one-off versus real ongoing costs disguised as personal.
• Revenue trend — is it stable, growing, or quietly declining? Beware a suspicious spike in the months right before sale.
• Revenue concentration — how much depends on a single product, client, or affiliate deal that could vanish?

If the seller can't or won't provide source data, that itself is your finding.

Traffic verification

Revenue depends on traffic, so verify the traffic is real and durable. Get read access to analytics and Search Console, not screenshots. Check where visitors come from and how diversified that is, whether search traffic is spread across many keywords or dependent on a few, and whether there are past traffic drops that line up with Google update dates. A history of getting hit by core updates is a serious risk, however good the current numbers look. This is the heart of any honest valuation.

Operational verification

Understand what you'd actually be taking over:

• Owner dependence — how much of the business lives in the owner's head, hands, or personal relationships? The more it does, the more you're buying a job.
• Processes and systems — is the work documented and repeatable, or improvised?
• Suppliers and contractors — who does the work, are they transferable, and is any single supplier a point of failure?
• Tech and content — is the site maintainable, and is the content genuine and durable rather than thin or spun in a way a quality update could punish?

Legal and ownership verification

Confirm the seller can actually sell you what they're offering, cleanly:

• Asset ownership — do they own the domain, content, code, brand, and accounts outright, with nothing licensed or borrowed?
• Trademark and IP exposure — is the brand safe, or is it riding on someone else's marks?
• Contracts and liabilities — any obligations, disputes, or terms that transfer with the business?
• Platform compliance — is the business in good standing with the platforms it depends on, or one policy strike from trouble?

Turn findings into a decision

Due diligence isn't pass/fail — it's a way to price reality. Some findings kill a deal (fabricated numbers, a fatal single dependency). Most simply adjust the price or the structure: a discovered risk justifies a lower multiple, an escrow, or an earn-out that protects you if the risk materializes. The goal isn't a perfect business — none exist — it's knowing exactly what you're buying and paying accordingly.

The takeaway

Verify the financials from source, confirm the traffic is real and diversified, understand the operations you'd inherit, and check the legal and ownership picture is clean. Do that methodically and you either buy with genuine confidence or dodge an expensive mistake — which is exactly what due diligence is for.