Due diligence is the unglamorous work that decides whether a website purchase succeeds or becomes an expensive lesson. A listing page shows you the seller's best version of the business; diligence shows you the real one. The checks below are grouped by what they prove, and a serious buyer works through all of them before signing a purchase agreement. Budget 30 to 60 days for the process on a small deal, and longer if the business is complex.

Start with the financials, because everything else is noise if the profit is not real. Ask for 12 to 24 months of profit and loss statements, tax returns, bank statements, and payment processor reports. Reconcile them against each other: platform revenue should match processor payouts, which should match bank deposits. List every add-back the seller claims, such as personal expenses run through the business, and challenge any that look like normal operating costs. Check for hidden liabilities too, including unpaid bills, loans, refunds owed, and open chargebacks.

Traffic verification comes next, and it must be done at the source. Get read-only access to Google Analytics and Google Search Console, plus ad accounts and affiliate dashboards. Break traffic down by source and by page: a site where 80 percent of visits come from one keyword or one paid channel is far riskier than one with spread-out sources. Look at the trend over 12 months, not just the last 30 days, and check for sudden drops that might signal a search penalty or a lost backlink. Verify that the seller owns the analytics property and that the data has not been filtered to hide bad months.

Content and SEO checks protect you from buying a site built on borrowed rankings. Check whether the content is original or spun, whether images are licensed, and whether the site has any manual actions in Search Console. Review the backlink profile for spammy or paid links that could trigger a penalty after you take over. Confirm the domain has no trademark conflict and that the seller actually owns it, with registrar access ready to transfer. Also check the age and history of the domain, since a domain with a spammy past can carry penalties that follow it.

Technical and operational checks decide whether you can run the site on day one. Ask for a full list of software, plugins, hosting, and third-party services the site depends on, with the monthly cost of each. Check whether the code, theme, or content management setup is something you or a developer can maintain. Confirm that email lists, social accounts, and ad accounts transfer with the sale, and that the seller will hand over passwords and documentation. For a site with contractors or writers, check their agreements and whether they will keep working after the sale.

Finally, verify the legal and commercial layer. Check supplier and affiliate agreements, advertising contracts, and any licences the business needs. Confirm there are no pending legal disputes, no unresolved customer complaints that could become chargebacks, and no non-compete restrictions on the seller that would stop them competing with you next month. Use a data room or staged disclosure: basic materials first, deeper financials after a confidentiality agreement, and the most sensitive files only after a letter of intent. If a seller resists any of these checks, treat that resistance as information, and be ready to walk away.

For larger deals, consider hiring help. An accountant can verify the financials and the add-backs far faster than you can, and a lawyer can review the purchase agreement, the non-compete, and the intellectual property transfer for problems you would miss. The cost is usually a small fraction of the purchase price, and it is money well spent on any deal above five figures. Even on a small deal, a one-hour legal review of the purchase agreement can catch a missing asset transfer or a liability clause that would otherwise become your problem after closing.