Buying a website: a due diligence checklist

Buying a website or an online business can be a faster way to grow than starting from nothing. It can also be an expensive way to buy someone else’s problems. The difference is almost always in the due diligence: what you verified yourself before you paid, rather than what the seller told you.

This checklist runs in roughly the order you’d work through a deal.

Know what you’re actually buying

Before you look at a single number, get clear on the shape of the deal:

• Which assets are included? The domain, the site and its code, the content, social accounts, the email list, supplier relationships, inventory, trademarks, software licences.
• Are you buying assets or the company? Buying a company’s shares can bring its history and liabilities with it. Your lawyer and accountant should weigh in early.
• What does the seller keep? Other sites, shared tools, a shared supplier account. Anything shared needs a plan to separate it.
• How much work does it take to run? Ask the seller to describe a normal week, honestly, and who does what.

Traffic: verify it at the source

Traffic numbers in a listing are a claim, not a fact. Ask for read-only access to the accounts themselves:

• Analytics. Look at at least a full year, so you can see seasonality, and longer if it exists. Check where visits come from: search, social, paid ads, referrals, direct.
• Search Console. It shows which searches and pages bring people in. If most traffic comes from a handful of pages or search terms, a single algorithm change could cut it hard.
• Paid traffic. If ads drive the sales, you’re buying an ad account as much as a website. Look at what’s spent and what it returns.
• Red flags. Sudden spikes just before the sale, traffic from countries the business doesn’t sell to, or a recent sharp drop the listing doesn’t mention.

Revenue and costs: follow the money

Ask for the reports the payment processor or platform produces, not a spreadsheet the seller made:

• Match reported revenue to processor reports and to bank deposits, month by month.
• Check refunds and chargebacks. A high rate can point to product or fulfilment problems.
• Look for concentration. If one customer, one affiliate partner or one marketplace makes up a big share of revenue, ask what happens if it disappears.
• List every cost, including the ones the seller covers personally or doesn’t count, like their own time, a freelancer, or tools billed to another business.
• Understand any recurring revenue. For subscriptions or SaaS, look at how many customers cancel each month and how long the average customer stays.

Search and reputation

• Manual actions. Search Console shows whether Google has taken action against the site for breaking its guidelines. Ask to see the report.
• Backlinks. A link profile full of paid or spammy links can be a liability, not an asset.
• Reviews and mentions. Search the brand name. Look at reviews, complaints and forum threads. What customers say in public is often more honest than the listing.

The tech

The website is the machine that makes the money. Have someone who understands it look under the hood:

• Platform and hosting. What it’s built on, where it runs, what it costs, and whether it can move to your own accounts.
• Code and licences. Who wrote it, whether you’ll own it, and whether paid themes, plugins or software licences can be transferred to you.
• Dependencies on the seller. Anything running through the seller’s personal accounts (email, payment processing, API keys, app store accounts) needs a transfer plan.
• Security and backups. Is the software up to date? Are there working backups? Has the site been hacked before?
• Speed and health. Slow pages and broken features cost sales. Better to know now than to discover it after the deal.

Legal and intellectual property

Your lawyer will lead here, but you should know what to ask about:

• Ownership of the content and code. In Canada, copyright generally belongs to whoever created the work unless it was assigned to someone else in writing. If freelancers built the site or wrote the content, check that the seller actually owns it and can pass it on.
• Trademarks. Is the brand name registered? Does anyone else use it?
• The email list. Canada’s anti-spam law requires consent for commercial email, and the sender has to be able to prove it. Ask how the list was collected and make sure the consent records transfer with it.
• Privacy. Does the site have a privacy policy that matches what it actually collects? Customer data you inherit comes with obligations.
• Contracts. Suppliers, affiliates, advertisers and contractors. Which contracts transfer, and which need the other party’s agreement?

The transfer: protect the money and the handover

Most deal problems happen in the last mile. Plan it before you sign:

1. Use a licensed escrow service. The buyer’s money is held until the assets are transferred and confirmed, then released to the seller.
2. Write a transfer list. Every account, file and asset, who moves it, and how you’ll confirm it arrived.
3. Move the domain carefully. For many domain endings, changing the registrant’s details triggers a 60-day lock on moving it to a new registrar. Agree with the seller and the registrar on the order of steps before you start.
4. Agree a handover period. A set number of days when the seller answers questions and helps with the transition.
5. Consider a holdback. Part of the price held back for an agreed period, released once it’s clear everything was as described.

A seller with a good business usually welcomes this kind of checking, because it speeds up a fair deal. A seller who resists read-only access or won’t show processor reports is telling you something important.