Website Due Diligence Checklist: What to Check Before You Buy (2026)

This guide is part of my series on buying digital businesses. Once you have a sensible valuation range, use this checklist before you send money or sign an asset-purchase agreement.

Buying an online business can be wonderfully clean compared with buying a physical one. No lease, no forklifts, no ancient machinery held together by optimism. It can also be deceptively easy to get wrong. A website may look good, show a nice profit screenshot, and still depend on one fragile Google page, one affiliate programme, one undocumented contractor, or traffic that vanishes when you take the wheel.

This is my practical website due diligence checklist for buying a content site, affiliate site, ecommerce business, small SaaS product, or app. It is not legal, tax, or financial advice; for a meaningful acquisition, involve an accountant and lawyer. But it is the work I would want done before deciding that an online business is actually worth buying.

The short version: what to check before buying a website

• Ownership: the seller owns the domain, code, content, accounts, trademarks, and customer data they say they own.
• Earnings: revenue, costs, and profit reconcile to primary-source accounts—not a pretty spreadsheet.
• Traffic: analytics and Search Console make sense, with no unexplained spikes, country mismatches, or dependence on one page.
• SEO: rankings, backlinks, content quality, and technical health are durable enough for the price.
• Operations: you can run it after handover, including suppliers, writers, support, hosting, and renewals.
• Risk: the biggest sources of revenue and traffic are understood, quantified, and reflected in the price and deal terms.

If a seller will not provide reasonable evidence for a material claim, treat that as evidence in itself. You do not need every answer on day one, but you do need enough to know what you are buying and what could break.

1. Confirm that the asset is real and transferable

Start with the boring question: what exactly is being sold? A website is usually a bundle of assets, not just a domain. List every asset and have the purchase agreement assign it explicitly.

• Domain name and registrar account, including expiry date, registrar lock, and two-factor authentication.
• Website code, theme, plugins, repositories, hosting, CDN, email, and backups.
• All content, images, licences, databases, and documentation.
• Analytics, Google Search Console, advertising, affiliate, payment-processor, app-store, and social accounts where transfer is permitted.
• Customer lists, email lists, subscriptions, supplier contracts, contractor agreements, and standard operating procedures.
• Business name, trademarks, and any legal entity or licences where relevant.

Check the domain’s history using the Internet Archive’s Wayback Machine. You are looking for continuity: a site that has broadly been about the same thing for years is less worrying than one that used to be a casino, a PBN, or a completely different business. Also check the WHOIS/registrar situation, renewal date, and whether the seller can demonstrate control of the registrar account live.

2. Reconcile the financials, month by month

For small online businesses, the usual valuation base is seller’s discretionary earnings (SDE): revenue minus the ordinary costs needed to run the business, with legitimate owner add-backs considered separately. Do not value a business from topline revenue or a single “average monthly profit” cell.

Ask for at least 12 months of monthly profit and loss detail—24 months where the business has meaningful seasonality—and reconcile it to source accounts. For each major revenue stream, inspect the real dashboard or export: affiliate network, ad network, Stripe, Shopify, Amazon, App Store Connect, subscription billing, or bank account. Screen recordings with filters and date ranges visible are much more useful than isolated screenshots.

• Revenue: Does monthly revenue match the underlying reports? Are refunds, chargebacks, taxes, and withheld payouts included?
• Expenses: Include content, developers, virtual assistants, software, hosting, customer support, advertising, fulfilment, and merchant fees.
• Owner add-backs: Challenge them. A cost is only an add-back if a buyer genuinely will not need to replace it.
• Working capital: For ecommerce, ask about inventory, purchase orders, returns, and cash tied up in stock.
• Concentration: What percentage of revenue comes from the biggest page, product, customer, affiliate partner, or advertiser?
• Trend: Separate normal seasonality from a structural decline.

A useful rule: if you cannot trace a claimed dollar of profit back to an independent primary source, do not pay a multiple for it.

3. Inspect traffic and conversion, not just pageviews

Open Google Analytics and Search Console yourself—read-only access is enough during diligence. For a Google-dependent site, Search Console is particularly important because it is the closest thing to first-party evidence of Google organic search performance. Google explains the main reports in its Search Console Performance report documentation.

• Review at least 16–24 months of monthly sessions, users, impressions, clicks, and conversions.
• Break traffic down by channel, country, device, landing page, and query.
• Identify the top 10 landing pages and calculate their share of total traffic and profit.
• Check whether traffic and revenue move together. If they do not, understand why.
• Look for sudden spikes, unexplained direct traffic, bot-like geographies, or a sharp post-update decline.
• For ecommerce and SaaS, track funnel conversion: visitor → lead/cart → sale → repeat purchase or churn.

There is no magic minimum traffic threshold. A 5,000-session site can be a great business if the economics are good; a 500,000-session site can be a disaster if the traffic is irrelevant or monetises poorly. What matters is whether the source, quality, conversion, and durability of traffic support the earnings claim.

4. Do real SEO due diligence

For a content or affiliate website, SEO is often the central risk. Do not reduce it to an “authority” score. Third-party scores can be useful shortcuts, but they are not a substitute for seeing what ranks, why it ranks, and how concentrated the result is.

• Ranking mix: Are the important queries commercial, informational, branded, or navigational? Do they match the stated business model?
• Page concentration: Could one or two pages losing rankings remove half the profit?
• Content quality: Is the content genuinely useful, current, and credibly produced—or thin, copied, or clearly scaled without editorial control?
• Backlinks: Review referring domains and link velocity. Look for paid-link footprints, irrelevant links, sitewide links, and expired-domain tricks.
• Technical health: Check indexing, robots directives, canonical tags, Core Web Vitals, redirects, broken pages, and mobile usability.
• Maintenance burden: List the pages that need regular updates to remain accurate or competitive.

Search has become less forgiving of generic content in recent years. For a content site, I would now explicitly ask: what is the original value here—experience, research, data, tools, a brand, a community, or a genuinely useful editorial process? “We published lots of articles” is not a moat.

5. Check the operational handover

Many online businesses are cheap because the seller is quietly the only person who knows how they work. Ask them to walk you through a normal month: publishing, customer support, vendor payments, product updates, reporting, and crisis handling. Record the calls if everyone agrees.

• Who does the work, how much are they paid, and can they be retained?
• Are contractor agreements clear on IP ownership and confidentiality?
• What subscriptions renew, who owns them, and which cannot be transferred?
• Is there a documented deployment, backup, security, and incident-recovery process?
• Which tasks have the seller been doing personally, and how many hours do they actually take?
• Are there supplier, platform, or affiliate terms that could change after a sale?

For software, add code review, dependency licences, security, uptime, support backlog, and customer concentration. For ecommerce, add supplier verification, stock count, lead times, landed cost, returns, and product-liability considerations. A checklist is not a substitute for changing the questions to fit the business.

6. Assess seller credibility and legal risk

It is normal for a seller to be protective before they know you are serious. It is not normal for material information to stay vague once you are in a real process. Check their identity and business entity, search for obvious disputes, and make sure contracts actually assign the intellectual property being sold.

For a material deal, your lawyer should review the purchase agreement, non-compete/non-solicit clauses where enforceable, representations and warranties, indemnities, transition support, and an escrow or holdback structure. A short transition period tied to clear deliverables is usually more valuable than a heroic promise to “help whenever needed”.

How to use this checklist in a real deal

First, do a fast screen: ownership, high-level revenue proof, traffic source, and obvious concentration risks. If it passes, request the detailed evidence and build a month-by-month model. Then turn the risks you find into a valuation adjustment, a condition of closing, or a deal term.

For example, if 60% of profit comes from one Google landing page, I would not simply write “risk” in a notes column. I would pay a lower multiple, ask for a longer transition or holdback, or walk away. The job of diligence is not to eliminate all risk. It is to make sure you know which risks you are accepting and are being paid for accepting them.

Next, read my guide to website valuation multiples to turn the quality of the asset into a price range.