Buying a Web Business: Due Diligence Checklist & Red Flags (2026)

Red flag: Inconsistent revenue recognition methods, significant discrepancies between reported revenue and merchant processing statements, or a high, undocumented customer churn rate (e.g., >5% monthly for SaaS) indicating poor customer retention and future revenue instability.

Ask: Please provide detailed historical revenue reports segmented by recurring vs. one-time, customer segment, and product/service line. How do you track and report churn rate, and what are the primary reasons for customer attrition?

Red flag: Excessive or undocumented personal expenses disguised as business costs (e.g., owner's car lease, personal travel, unrelated software subscriptions) that are not clearly justifiable as owner compensation or true business necessities.

Ask: Can you provide detailed documentation and justification for all SDE add-backs, including receipts, invoices, and a clear explanation of how each expense is non-recurring or personal to the owner?

Red flag: Lack of clear, verifiable data on CAC by channel (e.g., Google Ads, social media, SEO) or LTV, suggesting an unsustainable marketing model or an inability to scale profitably.

Ask: How do you calculate your customer acquisition cost (CAC) for each marketing channel, and what is the average customer lifetime value (LTV) across your primary customer segments?

Red flag: A significant portion of A/R is over 90-120 days past due, or a high percentage of A/R is from a single client, indicating potential cash flow problems or client concentration risks.

Ask: Please provide an aging report for accounts receivable. What is your average collection period, and what steps are taken for overdue invoices?

Red flag: Reliance on outdated, unsupported, or highly customized proprietary technologies that are difficult to maintain or integrate, or a significant backlog of unaddressed bugs and security vulnerabilities.

Ask: Describe the core technology stack (programming languages, frameworks, databases, hosting). Is there a documented technical debt strategy, and what is the current assessment of its severity and resolution plan?

Red flag: Critical business functions (e.g., development, specialized marketing, product management) are solely reliant on one individual with no cross-training, process documentation, or succession plan.

Ask: Who are the key personnel vital to daily operations, and is there comprehensive documentation of their processes, roles, and responsibilities? What is the staff retention history?

Red flag: Unoptimized cloud hosting configurations leading to excessive costs, single points of failure in server architecture, or lack of defined disaster recovery and backup procedures.

Ask: What is the current hosting environment and infrastructure? Please provide a breakdown of monthly hosting costs and details on backup frequency, recovery point objectives (RPO), and recovery time objectives (RTO).

Red flag: Undocumented or ad-hoc customer support processes, long average response times, or a high volume of unresolved tickets, signaling potential customer dissatisfaction and churn.

Ask: Describe your customer support channels, typical response times, and the volume of daily/weekly support tickets. Is there a customer knowledge base or defined escalation path?

Red flag: More than 20% of revenue derived from a single customer or less than five customers, making the business highly vulnerable to client loss.

Ask: What is the percentage of revenue contributed by your top 5 customers over the last 12-24 months? Can you identify any single points of failure in your client roster?

Red flag: The business operates in a crowded market with no clear differentiation, or its USP is easily replicable by competitors.

Ask: Who are your primary competitors, and what do you identify as the business's key unique selling propositions? How do you maintain a competitive advantage?

Red flag: Over-reliance on a single traffic source (e.g., organic Google search) with declining rankings, or a history of relying on black-hat SEO tactics that could lead to penalties.

Ask: What are your primary traffic sources over the last 24 months (e.g., organic, paid, direct, referral)? Provide access to Google Analytics/Search Console. Are there any known Google penalties or SEO vulnerabilities?

Red flag: The business operates in a niche market with little to no growth, or a shrinking market due to technological shifts or new industry regulations.

Ask: What is your assessment of the current and projected market size for your products/services? What trends do you see impacting this market in the next 3-5 years?

Red flag: Lack of clear IP assignment agreements from all relevant developers, designers, and contributors, or pending litigation regarding copyright/trademark infringement.

Ask: Are all custom code, design assets, and content registered or clearly assigned to the business? Provide copies of all IP assignment agreements with past and current contractors/employees.

Red flag: Outdated ToS or Privacy Policy, non-compliance with major data protection regulations (e.g., GDPR, CCPA), or a history of data breaches.

Ask: Are your Terms of Service and Privacy Policy current and compliant with relevant regional data protection laws? What is your protocol for data security and breach notification?

Red flag: Critical third-party service contracts (e.g., payment processors, content delivery networks, specialized software) are non-assignable or have unfavorable termination clauses, leading to potential operational disruption post-acquisition.

Ask: Please provide a list of all critical vendor contracts. Are they assignable upon sale of the business, and what are their renewal terms and costs?

Red flag: Lack of proper employment/contractor agreements, or existing agreements do not include robust non-compete/non-solicit clauses for key personnel, exposing the business to competitive threats post-sale.

Ask: Provide copies of standard employment and contractor agreements. Do these include non-compete, non-solicitation, and confidentiality clauses, and are they enforceable in relevant jurisdictions?

Red flag: Seller unwilling to provide a reasonable transition period (e.g., less than 30-60 days) or share critical operational knowledge, risking immediate operational disruption.

Ask: What specific support and availability can you offer for a transition period post-closing, and for how long? Do you have documented processes or SOPs for knowledge transfer?

Red flag: Inability to provide a comprehensive list of all required digital assets (e.g., domain registrars, hosting accounts, social media profiles, analytics platforms) or resistance to transferring full admin access.

Ask: Please provide a complete list of all digital assets, including domain registrations, hosting accounts, social media profiles, payment gateway accounts, and SaaS subscriptions. What is your plan for secure transfer of administrative access?

Red flag: No centralized CRM system, or an incomplete/outdated record of customer interactions, making it difficult to understand customer needs or maintain relationships.

Ask: What CRM system do you use, and how comprehensively is customer communication and interaction history tracked within it?

Red flag: Significant undocumented pending projects that could require immediate resources, or an unrealistic development roadmap that doesn't align with current capabilities.

Ask: What projects are currently in progress or planned for the next 6-12 months? Can you share your product development roadmap and any associated budgets or resource requirements?