How to Run Basic Due Diligence on a Website

Buying an established website requires a rigorous audit before you transfer any funds. Sellers often present best-case scenarios, meaning your due diligence process must systematically verify traffic sources, financial records, and operational dependencies to uncover hidden liabilities.

Verify Traffic Sources and Quality

Traffic is the lifeblood of any online business, but not all visitors are created equal. You must look beyond aggregate pageviews to understand where the audience originates and how stable those channels are.

• Request direct administrative access to Google Analytics or the site's primary analytics platform rather than relying on screenshots.
• Examine the ratio of organic search versus social, direct, and paid traffic to identify over-reliance on a single volatile channel.
• Check for sudden traffic spikes or dips that might indicate algorithmic penalties, algorithmic updates, or manipulative growth tactics like bought traffic.
• Analyze user engagement metrics such as bounce rate and average session duration to ensure the audience is genuinely consuming the content.

Audit Revenue and Financial Records

Verifying income requires corroborating dashboard data with actual bank statements and payment processor accounts. Never take a seller's profit-and-loss spreadsheet at face value.

• Cross-reference Stripe, PayPal, or affiliate dashboard exports directly with business bank account deposits for the trailing twelve to twenty-four months.
• Request complete tax returns or profit-and-loss statements that account for all operating expenses, including hosting, software subscriptions, and freelance labor.
• Calculate true net profit by factoring in hidden costs, particularly if the current owner spends significant uncompensated time on tasks you plan to outsource.
• Verify affiliate account ownership and payment details to ensure earnings can be successfully transferred to your corporate entity.

Uncover Technical and Legal Risks

A website can look profitable on paper while harboring severe technical debt or legal vulnerabilities that will drain your capital post-acquisition.

• Inspect the content management system, plugins, and custom code for outdated architecture or security vulnerabilities that require immediate remediation.
• Verify domain ownership history, registrar details, and ensure the domain is registered under an account you control completely.
• Review existing supplier agreements, contractor contracts, and copyright compliance regarding images, text, and software licenses.
• Check for any history of trademark disputes, DMCA takedown notices, or penalties from ad networks like Google AdSense.

Executing a disciplined due diligence checklist protects your capital and prevents costly surprises. Treat every claim as an assumption that requires independent verification before you finalize the purchase agreement.

Further reading

• How to Speed Up Your Website
• Migrate Without Losing SEO