Buying a Business Website: Due Diligence Checklist & Red Flags (2026)

Red flag: Significant discrepancies between reported revenue and third-party platform statements (e.g., AdSense, affiliate network payouts, Stripe/PayPal records). Revenue heavily reliant on a single, easily mutable source.

Ask: Please provide read-only access to all ad network, affiliate program, and payment gateway dashboards (e.g., Google AdSense, Amazon Associates, Stripe, PayPal) for the last 36 months, along with corresponding bank statements.

Red flag: Sudden spikes in paid advertising spend with no corresponding revenue increase, or a sharp decline in organic traffic indicating potential SEO penalties or over-reliance on a single, volatile traffic source.

Ask: Can you provide a detailed breakdown of all marketing and traffic acquisition expenses, including ad platform invoices and campaign performance reports over the past three years, and explain any significant changes in strategy or volume?

Red flag: Unaccounted-for large expenses, or critical software/hosting contracts expiring soon with pending price increases, or reliance on free/beta services that will soon require payment.

Ask: Provide a list of all recurring operational expenses, including subscriptions, hosting, content creation, and software licenses, along with current contracts and payment records. Are there any known upcoming price increases for these services?

Red flag: Seller's add-backs that are clearly essential for baseline business operation (e.g., owner's salary when the owner performs critical, non-delegatable tasks) or non-recurring expenses that are vague/unsubstantiated.

Ask: Please provide a detailed SDE calculation with all add-backs clearly identified and supported by documentation (e.g., personal travel expenses run through the business, non-essential owner perks). How many hours per week do you personally dedicate to the business, and what specific tasks do you perform?

Red flag: Outdated or plagiarized content, thin content, or a large percentage of content that hasn't ranked or driven traffic in years, indicating a need for extensive overhaul or removal.

Ask: Provide access to the content management system (CMS) and Google Analytics. Can you outline your content generation process, frequency, and any specific SEO strategies applied to content, especially for top-performing pages?

Red flag: Outdated content management system (CMS) with security vulnerabilities, deprecated plugins, slow loading speeds, mobile unfriendliness, or a fragile hosting setup prone to downtime.

Ask: What content management system (CMS) and hosting provider do you use? Can you provide a list of all installed plugins/extensions and themes, and describe the frequency and process for backups and security updates?

Red flag: Heavy reliance on a single, volatile traffic source (e.g., a specific social media platform or a single Google keyword), or unexplained drops/spikes in traffic that seller cannot account for.

Ask: Provide read-only access to Google Analytics, Google Search Console, and any other relevant traffic analytics platforms for the past 36 months. Can you explain the primary traffic acquisition channels and their relative contribution to overall site visits?

Red flag: Monetization methods that violate platform terms of service (e.g., aggressive ad placement), or expiring affiliate contracts with no clear renewal path, or a product line that is stagnant/outsourced without clear vendor agreements.

Ask: Detail all current monetization methods, including ad network contracts, affiliate agreements (e.g., commission rates, terms), and any direct product/service offerings. Are there any active contracts or partnerships that are expiring within the next 12 months?

Red flag: A clearly declining market trend for the website's core niche, or extremely low search volume for relevant keywords, indicating a shrinking audience or limited growth potential.

Ask: How have you assessed the current and future demand for the niche this website serves? What competitive trends have you observed, and how has the website adapted or plans to adapt to them?

Red flag: Numerous large, well-funded competitors dominating the search landscape or a unique market differentiator that is easily replicable by larger players.

Ask: Who do you consider the primary direct and indirect competitors for this business website? What are their strengths and weaknesses compared to your site, and what is your competitive advantage?

Red flag: Deteriorating engagement metrics (e.g., increasing bounce rate, decreasing time on site, low social shares) or an audience profile that doesn't align with monetization strategies.

Ask: Describe your primary audience demographics. How do you engage with your audience, and what are the key engagement metrics for the website and any associated social media or email lists?

Red flag: Reliance on black-hat SEO tactics, a significant number of low-quality or spammy backlinks, or a history of Google penalties.

Ask: Can you provide a detailed report of the website's backlink profile (e.g., Ahrefs, SEMrush data)? What specific SEO strategies have been implemented, and have there been any historical Google algorithm updates that significantly impacted traffic?

Red flag: Domain registered in a personal name that the seller is unwilling or unable to transfer, or pending domain disputes, or domain managed by a third party with unclear transfer processes.

Ask: Who is the current registrar and registrant of the domain name(s)? What is the exact process and estimated timeline for a full transfer of domain ownership?

Red flag: Content that is not original or is under license from a third party without clear assignability, or custom code developed by external contractors without a clear 'work for hire' agreement.

Ask: Confirm that all content, code, and trademarks used on the website are solely owned by the seller or have assignable licenses. Can you provide documentation for any content or code developed by third parties?

Red flag: Outdated or non-existent privacy policy, lack of cookie consent mechanisms, or terms of service that do not adequately protect the business, especially concerning user-generated content.

Ask: Are the website's Privacy Policy, Terms of Service, and cookie consent mechanisms compliant with current data protection regulations (e.g., GDPR, CCPA)? When were these last reviewed or updated?

Red flag: Non-assignable contracts with critical vendors, non-compete clauses that could hinder future growth, or unfavorable terms with major revenue partners.

Ask: Please provide copies of all active contracts with ad networks, affiliate programs, hosting providers, content creators, or any other third-party vendors. Are there any clauses that would prevent transfer or assignment upon sale of the business?

Red flag: Seller's reluctance to provide full administrative access to platforms, or reliance on complex manual data migration rather than direct account transfers.

Ask: What is your proposed process and timeline for transferring all digital assets, including domain, hosting, CMS, analytics, ad network accounts, and social media profiles?

Red flag: Seller offering minimal or no post-sale support, leaving the buyer to figure out complex systems or proprietary processes independently.

Ask: What level of post-sale training and support are you willing to provide, including duration and scope for critical areas like content management, technical maintenance, and monetization optimization?

Red flag: Seller unwilling to introduce the buyer to critical content writers, developers, or affiliate managers, potentially disrupting ongoing relationships.

Ask: Will you facilitate introductions to key content collaborators, developers, hosting support contacts, and affiliate program managers to ensure a smooth transition of relationships?

Red flag: Critical processes that rely entirely on the seller's manual intervention without documented procedures, or a content pipeline that will immediately cease post-sale.

Ask: Describe all automated systems in place (e.g., email automation, social media scheduling). What is the current content production pipeline, and how will it be maintained post-acquisition?