Buying a Business Online: Due Diligence Checklist & Red Flags (2026)

Red flag: Seller cannot provide read-only bank or payment processor statements, or gross sales don’t match tax returns.

Ask: Can you give me six months of read-only PayPal/Stripe and merchant account statements, and the last two years’ tax returns?

Red flag: Less than 20% of revenue is subscription or repeat, and high churn is masked by one-time sales.

Ask: What percentage of monthly revenue is recurring, and what is the average customer lifetime?

Red flag: Unexplained ‘marketing’ or ‘consulting’ expenses that are essential to traffic, or large personal expenses run through the business.

Ask: Walk me through each major expense line — which ones will continue under my ownership and which are personal?

Red flag: Dispute rate above 1% for card processing or frequent platform penalties indicating customer dissatisfaction.

Ask: What is your monthly chargeback ratio on each payment processor, and can you share refund logs for the past 12 months?

Red flag: Domain registered in seller’s personal name without clear transfer or admin panel access, or the site built on a proprietary platform that can’t be exported.

Ask: Who holds the domain registration and hosting accounts? Can you provide full admin credentials and initiate a transfer before closing?

Red flag: Over 70% of traffic from a single organic search term or ad campaign, or heavy reliance on one social media account tied to the seller.

Ask: What are your top five traffic sources by volume and revenue share over the last 12 months? Show me Google Analytics by channel.

Red flag: List built without opt-in consent or stored on a personal Gmail account; no way to export and import to a new ESP.

Ask: How is the email list managed, and can I legally assume the subscriber data? Provide an export of active subscribers and engagement stats.

Red flag: Key product descriptions, blog posts, or code were written by freelancers without work-for-hire agreements, creating copyright risks.

Ask: Do you own all the copyrights to content, images, and any custom software? Show me the contracts with any writers or developers.

Red flag: Dropshipping or wholesale supplier refuses to continue after sale, or seller is the only point of contact.

Ask: Which suppliers are critical, and are there agreements in place? Will you introduce me and confirm they will honor existing terms post-sale?

Red flag: Three or more deep-pocketed competitors launched similar products, or the business competes solely on price with no differentiation.

Ask: Who are your top three competitors, and what is your unique selling proposition that keeps customers from switching?

Red flag: Rankings are driven by black-hat techniques or a single ‘money page’ that could be hit by an algorithm update.

Ask: Can I see a third-party backlink audit and keyword position history? Have you ever received a manual action from Google?

Red flag: Social pages are personal profiles that can’t be transferred, or the brand name has no trademark and can be easily copied.

Ask: Is the business name trademarked? Can you transfer all social media accounts and the brand’s goodwill smoothly?

Red flag: Customer base is aging with no influx of new cohorts, or the niche is shrinking according to Google Trends.

Ask: What does the average customer look like, and how has monthly new customer acquisition changed over the past three years?

Red flag: Seller wants to sell shares instead of assets, implicitly transferring hidden liabilities, or won’t clearly list all digital assets.

Ask: Will the deal be structured as an asset purchase? Provide a detailed asset list including domain, URLs, customer list, and all digital properties.

Red flag: Seller cannot demonstrate that all images, code, and content are original or properly licensed, risking DMCA takedowns.

Ask: Show me the licenses for any stock images, themes, or plugins, and the ownership status of any custom-built features.

Red flag: The site lacks a privacy policy or collects customer data without GDPR/CCPA compliance, exposing the buyer to fines.

Ask: How do you collect and store customer data? Have you had any data breach or privacy complaint? Provide the privacy policy and cookie consent records.

Red flag: If inventory is held, lease is in owner’s name and landlord won’t assign, or an Amazon FBA account isn’t transferable under marketplace rules.

Ask: If you hold inventory, where is it stored and is the lease transferable? Are there any marketplace account restrictions on sale?

Red flag: Seller offers only a two-week handoff with no ongoing support, then may start a competing site.

Ask: What is your proposed training period, and are you willing to sign a non-compete for at least two years in the same niche?

Red flag: Processor won’t underwrite a new owner, causing a gap in payment acceptance post-close.

Ask: Can we get pre-approval from your payment processor for a change of ownership? What’s the plan to avoid downtime?

Red flag: No plan to announce the change, leading to customer confusion, chargebacks, or supplier defection.

Ask: Will you co-author a handover email to your top 20 customers and key partners? How do we ensure retention?

Red flag: Missing passwords, scattered tools, or lack of standard operating procedures, forcing the buyer to reverse-engineer operations.

Ask: Do you have a complete inventory of all accounts, tools, and SOP documents? Can you demonstrate them before closing?