Buying a Business Website: Due Diligence Checklist & Red Flags (2026)

Red flag: Seller insists revenue numbers are 'aggregated' in their own spreadsheet but refuses live dashboard access — likely fabricated numbers.

Ask: Can I screen-share while you log in to the live Stripe, PayPal, AdSense, and affiliate network dashboards, and export the last 12 months of transaction data?

Red flag: Organic traffic dropped 40%+ after a core algorithm update and hasn’t recovered, or over 70% of traffic comes from a single source like a Facebook page.

Ask: Will you grant viewer access to Google Analytics and Google Search Console so I can verify daily users, source/medium, and keyword rankings over the past 24 months?

Red flag: The seller’s 'profit' excludes $2k/month in outsourced content that will continue to be necessary, inflating SDE by 30%.

Ask: Please provide a detailed P&L with all costs: hosting, CDN, premium plugins, content writers, virtual assistants, refunds, chargebacks, and any ad spend. What personal expenses run through the business?

Red flag: List of 50,000 but last six campaigns had 5% open rates and a 2% spam complaint rate — the audience is dead.

Ask: What is the size, open rate, click rate, and list-cleaning frequency of the email list? Can I see recent Mailchimp/ConvertKit campaign reports?

Red flag: All revenue comes from Amazon Associates, where commissions are capped at a low rate, with no diversification — one TOS change kills the business.

Ask: Do you have any direct ad buys, sponsored post agreements, or recurring subscription revenue? Please share copies of active contracts.

Red flag: Domain is registered under a third-party administrator who is unresponsive, or the domain was used for a previous site that got a manual penalty.

Ask: Is the domain registered in your personal name or a company? Will you unlock it and provide the transfer authorization code within 24 hours of closing?

Red flag: The sole owner does all writing themselves with no documented keywords or style guide — the site’s output ceases after sale.

Ask: Who writes, edits, and uploads content? Do you have a documented SOP for new posts, image optimization, and internal linking?

Red flag: The site uses cracked premium plugins or a theme without a license key, creating security vulnerabilities and legal risk.

Ask: What CMS, theme, page builder, and plugins are used? Are all premium plugins on valid developer licenses that can be transferred, or are they GPL nulled?

Red flag: Dozens of spammy, irrelevant backlinks from known PBNs that are likely to trigger a link penalty — disavow cleanup will take months.

Ask: Have you ever purchased backlinks or used a PBN? Please provide a SEMrush or Ahrefs export of referring domains so I can check for link spam.

Red flag: The entire checkout function depends on a single developer’s custom script with no documentation — and the developer is the seller’s cousin.

Ask: Which external services does the site rely on (payment gateways, advertising APIs, social media auto-posting)? What happens if an API key expires?

Red flag: The niche has large media brands and government sites on page one; the site ranks on page three for its money keywords and gets only long-tail trickle traffic.

Ask: Who are your top three direct competitors, and what prevents a new player from replicating your top 10 pages and ranking above you within six months?

Red flag: Site crashed during the Helpful Content Update and flatlined — the site likely has thin, AI-generated content that Google demotes.

Ask: Have you been hit by any Google core updates (e.g., September 2023, March 2024)? If so, did traffic recover? Please share the Search Console impression graph.

Red flag: 80% of annual revenue occurs in Q4 with no plan for the rest of the year, requiring massive cash reserves to ride the troughs.

Ask: Is revenue steady month-to-month, or does it spike seasonally? Can you show month-by-month revenue for the past 24 months?

Red flag: Seller has tried and failed to expand to YouTube and Pinterest for two years, indicating audience interest is capped.

Ask: What untapped growth channels exist (Pinterest, YouTube, email, paid ads) and have you tested any? Why didn’t you pursue them?

Red flag: Most content is outdated ‘best X for 2022’ posts that need a full rewrite to rank again — equivalent to starting over.

Ask: How often do you update existing content, and what share of posts are over two years old? Is there a plan to avoid content decay?

Red flag: Stock images used without proper licensing, or ghostwriters who retained copyright — exposing the buyer to DMCA takedown demands.

Ask: Who holds the copyright to the articles, images, and videos? Did you hire writers under work-for-hire agreements? Can I see the contracts?

Red flag: No privacy policy, and the site collects European visitor emails without GDPR consent — risk of fines up to 4% of annual revenue.

Ask: Is there a privacy policy? Do you collect email addresses or use cookies? Are you GDPR and CCPA compliant with cookie consent?

Red flag: FTC violation: no affiliate disclosure on thousands of posts, risking penalties and clawback of commissions.

Ask: Are affiliate links disclosed per FTC requirements? Can you show me where the disclosure appears on every post with affiliate links?

Red flag: Domain is a typo-squatted version of a major brand, and the seller ignores that a UDRP could seize it at any time.

Ask: Has the domain ever been challenged in a UDRP proceeding or received a cease-and-desist? Is the domain name itself trademarked?

Red flag: Seller operates as a sole prop with no entity, and wants to sell the asset but won’t indemnify for pre-close chargeback claims.

Ask: Is the website operated under an LLC or sole proprietorship? Will I purchase the asset or the whole entity, and how will liabilities (chargebacks, refunds) be handled post-close?

Red flag: Seller wants to hand over credentials via email without using a password manager, or resists sharing the hosting account’s root password.

Ask: Will you provide a detailed handover document with all logins, renewal dates, and contact info for service providers? What is your protocol for transferring credentials?

Red flag: Seller offers ‘unlimited support’ but has already moved on to another venture and is unresponsive within a week.

Ask: What does your 60-day post-sale support look like? How many hours per week, and will you train me on the content workflow, ad optimization, and vendor management?

Red flag: All content production relies on a single overseas freelancer who the seller refuses to put in direct contact with the buyer.

Ask: Will you introduce me to your writers, editors, and VAs, and facilitate the transfer of relationships or assign their freelance contracts?

Red flag: Site is hosted on the seller’s personal shared hosting plan bundled with 20 other projects — extracting it will be a messy, risky migration.

Ask: Are you willing to push the domain to my registrar account, and assist with migrating the site to my hosting without causing downtime?

Red flag: The seller has 30 unfulfilled online course access credentials and a backlog of support tickets, and expects the buyer to handle them without adjustment.

Ask: Are there any pending refund requests, affiliate commission clawbacks, or undelivered digital products that will become my responsibility?