Buying a small online business can be a shortcut to owning a cash-flowing asset, but only if you verify what you are actually buying. A listing's headline revenue figure is a starting point, not a fact. Your job during due diligence is to confirm the numbers, understand where the money comes from, and find the risks the seller has not mentioned.

Start with revenue and profit verification. Ask for at least 12 months of bank statements, payment processor reports, and profit-and-loss statements, then reconcile them against each other. If the seller reports profit, check whether owner salary, software subscriptions, contractor costs, and advertising spend are all included. Many small businesses look profitable only because the owner's time is valued at zero.

Next, examine traffic and customer acquisition. For a content or e-commerce business, ask for analytics access and look at the trend, not just the totals. Is traffic growing, flat, or declining? Does one channel, one keyword, or one platform drive most of the revenue? A business dependent on a single traffic source is riskier than one with several, and you should price that risk into your offer.

Operations matter as much as numbers. List every task the owner does weekly, from content updates to customer support to supplier orders, and estimate how many hours they take. Check whether key relationships, such as suppliers, freelancers, or affiliate partners, will transfer to you. If the business stops working the day the seller walks away, you are buying a job, not an asset.

Finally, cover the legal and technical transfer. Confirm the seller owns the domain, trademarks, content, and code, and that there are no outstanding disputes, loans, or tax liabilities attached to the business. Get written confirmation that accounts, ad accounts, and supplier contracts can be transferred, and use an escrow service or a staged payment so funds release only when assets are in your name.

Work through this checklist before you sign anything, and walk away if the seller refuses access to the underlying data. A good deal survives scrutiny; a bad one depends on you skipping it.

Pay attention to how the seller communicates during due diligence, because evasiveness is itself data. A seller who delays access to analytics, provides screenshots instead of live logins, or answers detailed questions with vague reassurances is signalling that something may not survive scrutiny. Reasonable delays happen, but a pattern of deflection across several requests is a reason to slow down, ask for more evidence, or reduce your offer to reflect the uncertainty.