Comprehensive Website Due Diligence Checklist

So, you’ve decided to purchase an online business (which we’ll interchangeably refer to as a “website”) and perhaps you’ve signed an LOI or even made an offer, contingent on everything checking out during due diligence. Now what? Well, it’s time to dig into the details and make sure everything checks out. The post-LOI stage is a crucial one as you have a lot of information to sift through, usually under some sort of time constraint.

Well, given there’s a lot to do and likely not a lot of time to do it, there’s only one course of action to take (besides curling up into a ball and crying), and that’s to create a checklist! Again, this stage is crucial and one thing missed during due diligence could lead to months or years of headaches down the road. Luckily, we’ve put together a fairly comprehensive due diligence checklist so you can ensure you’re not missing anything. Plus, this checklist is based primarily on the work we do with our Live Verification Report, so it’s been tried and tested many times over. (Disclaimer: There are a lot of components that are included in the Live Verification Report that haven’t been added to this list, simply because they require expertise to really assess or are based on our own proprietary algorithms.)

This checklist is general and can be applied to most online businesses. In the future, we’ll either update this post with more specific due diligence criteria for different business models (eCommerce, content, SaaS) or create different posts and link to them. Without further ado, let’s get into this:

Understand the Business

Before we get into the nitty-gritty, we highly recommend understanding the basics. You would be surprised by how many people look into buying a website simply based on the numbers and don’t really understand how the business itself really works. So, be sure you can answer the following questions:

  • How does the business generate revenue?
    • The answer shouldn’t simply be “It’s an affiliate business” or “It’s an eCommerce business” but rather, something along the lines of “The business generates revenue by providing detailed reviews on the best coffee makers for those looking to make a purchase. When a user visits the website and reads a review regarding a coffee maker they’re interested in, they can optionally click a link that will take them to Amazon to purchase that coffee maker. If they do make that purchase within 24 hours, the business receives a % comission from Amazon.” This may sound trivial but when you present it in laymen terms, it not ensures you truly understand the business, but also helps you spot any red flags with the fundamentals.
  • How does the website generate traffic?
    • Again, try and be as specific as possible. “Organic traffic” doesn’t tell us much. Try to aim for something along the lines of “The business primarily drives traffic through search results from their coffee marker review guides, of which they post 10 per month. They also receive traffic from the 2-3 guest posts they do on other lifestyle and coffee-oriented blogs.”
  • What are the risks associated with this business and how can you offset those risks?
    • A great example here would be “The business receives 100% of its revenue from Amazon’s affiliate program, which entails there could be a significant loss in revenue due a future change in comission structure. I can offset this by signing up for other affiliate programs and ensure my revenue sources are diversified.”
  • What are the greatest opportunities with this website and how can you take advantage of them?
    • It’s fine if you’re looking to buy a website simply to continue operating it as-is. However, at some point, you’re either growing or declining, so you want to at least be aware of the growth opportunities.

Verify the Age of the Business

We recommend conducting a three-point check when verifying the age of the business, meaning you want to use a combination of all three. We’ll use the example of a business that is claimed to be established on March 1st, 2015.

  • Domain Verification: For this, you want to use a WhoIs service (there’s plenty of them and they all essentially work the same way) to ensure that the age of the domain is on or before the claimed establishment date. Simply input the domain name and look for the Domain Registration Date. You want to ensure this date is on or before March 1st, 2015. We typically give this a bit of wiggle room (5-10% or so) but, for example, if you see December 18th, 2019 as the Domain Registration Date for this business, it either means that the business wasn’t really established on the date it’s claimed to be or it was operating on a different domain before. Either way, you want to look into this further.
  • Business Archives Verification: For this, we recommend using the Wayback Machine and inputting the URL. After that, look for the first archived record. You want this to be in the vicinity of the date established. Most of the times, the first archived record you find will be after the established date, which makes sense as the “robot crawlers” take some time for find the web pages. We’d recommend allowing up to 6-10 months of leeway here.
  • Financials Verification: For this, you simply want to ensure that the business was generating revenue sometime close to the established date. This one is a bit tricky because while it’s the most definitive method, not everyone has finances dating back to their establishment date. Some owners never anticipated selling the business, others were simply doing it as a side gig at the time, and various other reasons. So, if you can find finances dating all the way back to March 1st, 2015 for this example business, great! However, if the owner only has finances dating to June of 2018, don’t be alarmed.

Ensure Domain Name Transferability

The last thing you want is for the website to not be transferable to you because of some restrictions with the domain extension. Luckily, this doesn’t apply to most domain names. For example, if the business you’re looking to purchase has a .com, .net, .org, or .io (among countless others, we’ve just listed the most common ones), you can check off this section and move on, as you won’t have any issues receiving the domain.

On the other hand, domain extensions such as .gov, .int, .edu are all restricted and cannot simply be transferred over to anyone. For a comprehensive list of domain extension restrictions, we highly recommend this Wikipedia article.

Restricted Industry Check

You want to ensure the online business you’re buying is not in a “restricted industry” and if it is, be sure to understand the risks associated with it. Restricted industries include, but are not limited to alcohol, adult content, weapons (including guns, collector knives, hunting equipment), gambling (including sports betting, lottery, online casino websites), cannabis, tobacco (including vaping), and really, anything else that may raise eyebrows. This includes direct sales of products, advertising, or affiliating with these industries. There are definitely industries that are clearly risky and some that are questionable, and it’s really up to you to decide where you draw the line. For example, we provide an “Industry Risk Analysis” as part of our Live Verification Report where our algorithm determines the amount of risk a website’s industry has based on various data sources, scraping legal documents, and company policies to understand the prevalence and severity of the risk. That’s how we do it and you’re welcome to do it in a way that suits your needs.

If your prospective website is in a restricted industry, that doesn’t necessarily mean you shouldn’t purchase it, just that you should be aware of any legal and non-legal repercussions. For example, if you’re purchasing a business that sells hunting rifles and one of your growth plans is to advertise on Facebook, you wouldn’t be able to do that since Facebook does not allow advertising weapons on their platform.

Responsive Design Test

If a website is not responsive (also known as “mobile-friendly”), that’s a problem both from a User Experience (UX) and SEO perspective. If this is the case, it’s usually not a very tough thing to implement for most websites — though you want to confirm this during the due diligence stage with someone who has web development experience. The easiest way to know if a website is mobile-friendly is by simply plugging it into Google’s Mobile-Friendly Test.

Review Customer Satisfaction

The owner may have a very positive outlook on their business (it’d be a bit strange if they didn’t), but that doesn’t mean everyone else does too. One of the best ways to get an understanding of the business’ standing with its customer or user base is to simply search for it with something as simple as “<Business Name> Customer Reviews”. You’ll have more luck with businesses that sell products such as eCommerce or SaaS businesses but advertising and affiliate sites will also sometimes have reviews.

Some great sources include Google Reviews, Facebook, Twitter (search for the company’s @ or name), BBB, Reseller Ratings, Yelp, TrustPilot, Capterra, and more. Again, we take a much more systematic approach in the “Customer Satisfaction Score” component of our Live Verification Report where we scrape all of the available reviews, aggregate based on relevance, and give it a score out of 5. This not only helps provide a holistic understanding but helps our clients compare customer satisfaction for different businesses based on a numeric metric. Of course, you don’t have to do it this way and simply looking for reviews online and assessing them should put you miles ahead of the curve.

Reviewing Competitors

This is a bit of an involved process that could likely use its own blog post or mini-course but we highly recommend reviewing the website’s competitors. This will help you understand where your prospective online business holds its competitive advantage(s) and where it can improve. Two great tools to do this are Semrush and Ahrefs (they’re both paid options but we’re yet to find a really good one that’s free).

We also use this as a starting point when assessing competitors for a business but we take it a step further and go into industry-specific and business-model-specific comparison websites. For example, Semrush and Ahrefs may provide a good starting point for viewing a SaaS business’ competitors, but your best results will come from various websites such as G2 that specialize in comparing various software products. This process does take some time if it’s your first time — especially finding the best sources for comparisons based on the business model and industry. However, don’t let that overwhelm you. Start with the basics and work your way up.

Policy Checks

You want to ensure that the business has all of the required policies in place, preferably with easily accessible and visible links (such as from the homepage or the website’s footer). There are some fairly specific ones for certain industries but the following should cover most online businesses:

  • Privacy Policy
  • Terms and Conditions
  • Refund Policy (if the business is selling any products, including digital)

Financial Due Diligence: Verifying the Truth

When conducting financial due diligence, there’s one point you should remember: It’s a lot easier to conceal real costs than it is to create fake revenue. Most new buyers obsessively check for revenue discrepancies and while that’s important, most reputable brokers double-check revenues and ensure everything matches up. To be clear, we’re not advocating you take anyone else’s word for it, but instead spend as much time on confirming costs as you do verifying revenue, if not more. After all, for most modern websites, verifying revenue is a matter of logging into a merchant account such as Stripe and cross-checking with a business bank account. The problem becomes undisclosed costs, and whether that’s intentional or inadvertent, the onus is on you to confirm as a buyer.

So, we highly recommend verifying and reviewing all revenue live (or get added as a read-only user to the business’ payment processor) but also taking some serious time out to ensure all costs are being accurately reported. And while you’re doing that, remember to focus on the big stuff! Getting good at spotting discrepancies really becomes more about practice and experience (so get out there and look through as many websites as possible) but there are definitely some good places to start:

  • eCommerce: For eCommerce sites, your biggest killer will be underreported Cost of Goods Sold (COGS). You want to try and get as many supplier invoices as possible and make sure they match up with what’s being reported.
  • SaaS: For SaaS businesses, the biggest thing you want to look into is software development costs (including and especially software maintenance costs) and hosting costs. These can add up real fast and it’s a bit trickier to spot them. One of the ways we confirm this as part of our Codebase and Tech Stack Analysis is by reviewing the software’s source code (and the frequency and volume of updates) through GitHub or other version control software. For example, if a seller claims that they only pay $100 / month for basic software maintenance by a developer and we find multiple updates per month and 1000s of lines of proprietary code added, well there’s definitely something fishy going on that’s worth investigating. (Psst..If you’re lost and have no idea what this source code or GitHub sorcery is, we recommend brushing up on your technical prowess.)
  • Affiliate: With affiliate websites, the major thing you want to look out for is content and backlinking costs (as well as general SEO costs). In general, on-site content is fairly traceable as it’s all in one place, though we do recommend confirming via invoices that writers are being paid what is being claimed. Now, where it starts to get a bit tricky is backlinks and blog post content. The best way to approach this would be to see where a majority of the referral traffic is coming from and ensure that it’s accounted for. For example, perhaps the seller has listed costs for twenty blog posts in a given month. However, there seems to be no mention of any guest posts, despite the fact that six websites are referring back to this site from a guest blog post in a given month. That’s definitely something worth looking into.

Financial due diligence is a vital part of the due diligence process but perhaps one of the toughest to simply “teach” in a broad sense. It really requires you to go through the financial statements of different businesses until you get comfortable and start to see the patterns. So, start small, get familiar with various patterns, terminologies, and statements. And before you know it, you’ll be an expert in your own right (or slamming your head against a wall, no promises).


Financial Due Diligence: Patterns & Trends

Verifying costs and revenue will ensure you can find individual discrepancies, such as understated costs or overstated revenue. However, it’s equally important to highlight patterns and trends in the financials to get a much more holistic view and find issues that would otherwise go unnoticed. Here are a few things we recommend looking for:

  • Growth: In particular, we recommend calculating the average Month over Month (MoM) growth % since inception, the last three years, trailing twelve months, and the last three months. This will give you a fairly holistic understanding of whether the business is trending upward or downward. For example, perhaps the average MoM growth % since inception is 10% and the last three years is 12%, while the last twelve months is 20% and the last three months is 30%. This may indicate that the business has started to establish initiatives in the last year or so that are creating strong, compounding growth.
  • Profit Margins: We recommend repeating the steps above from “Growth” for profit margins as well. For example, take the average monthly profit margin since inception, the last three years, trailing twelve months, and trailing three months. You can definitely add more data points as well (e.g. last month, trailing two months, trailing six months, trailing two years, trailing three years, and so forth). This will help primarily in two ways: (1) You’ll be able to recognize any major changes in profit margin % in the business. For example, if the trailing three years, two years, and twelve months all show a 67% profit margin whilst the trailing six months shows a jump to 82%, something has changed, and it’s worth finding out what. (2) You’ll be able to understand economies of scale within the business a lot better. For example, if you’ve noticed increased growth based on your research in the “Growth” section, how has that affected profit margin %?
  • Financial Consitencies: The importance of this varies by individual but we recommend looking into the consistency of revenue and profit in the business, especially if the business will be your primary source of income. The simplest but least systematic way to assess financial consistency would be by simply plugging in the monthly revenue and profit into Excel and viewing the data with a bar or line graph. A more systematic way to approach this would be to understand the standard deviation between the months (lower standard deviation means less variance, higher standard deviation means higher variance). We’ve actually taken it a step further and provide a Revenue Consistency Score (RCS) and Profit Consitency Score (PCS) as part of our Live Verification Report, which is a more advanced version of simply taking the standard deviation as it penalizes volatility in the revenue and profit but does not penalize growth (since technically, purely viewing the standard deviation could be a bit misleading if the business is constantly growing) and provides a numerical value between 1-10 to depict the consistency for ease of assessment. Now, if all of this talk about standard deviation and calculation is overwhelming you, don’t worry: Even simply viewing the data in a graph format to visually see the variance will put you in a much better than position than if you were to skip this altogether.

We know the overall due diligence process is a lot to take in, especially the financial due diligence component. However, as with most things, it gets easier and you get better with time. That being said, if you prefer to outsource this, whether to simply avoid the headache or have an experienced team to have your back in case you miss something, we do include general financial due diligence, including a review of revenue and expenses, as part of our Live Verification Report. If you want something a lot more exhaustive and thorough, we highly recommend looking into a Quality of Earnings Report, which is conducted by a team of highly qualified and experienced Rapid Diligence CPAs that have looked at billions of dollars worth of deals.

Understanding the Business Valuation

One of the questions you’ll certainly be asking yourself throughout the process is how much is this business really worth? And it’s a very fair question. If you’re going through a broker or a marketplace, there will likely be an “asking price” set by the broker and seller. This price is almost always negotiable (unless the business is in really high demand or market conditions are a bit berzerk, as they are at the time of writing). The challenge, though, is to understand what you should offer so that you get the best deal but also aren’t simply “low balling”, which may discredit you as a genuine buyer.

Well, before we answer that question, it’s imperative to understand that there are a lot of factors that go into valuing an online business, including but not limited to, the age of the business, business model, industry, profit margin, weekly work required, existing Standard Operating Procedures (SOPs), existing competition, intellectual property, market conditions, SBA eligibility, growth rate, revenue, profit, and the list goes on and on. So, how can you know if you’re getting a fair value? Well, bearing in mind that there’s no perfect methodology here and most valuations have some level of subjectivity, we’d suggest two methods:

  • Finding similar businesses: This is definitely the easier of the two methods. Simply put, you can look into businesses similar to yours that were sold and for how much. One of the ways you can do this is by simply searching through a broker’s website (preferably the the one you’re working with) for similar businesses that have been sold and asking them for data on the sale price. Not all of them will provide it, but many will, especially if they feel you’re serious about buying the business. And there’s no need to conceal your intentions: You can simply mention you’d like to know to come up with a fair offer. Another great resource is Empire Flipper’s State of the Industry Report. This provides a great breakdown between different business models, etc. and will help you understand a fair multiple. Again, this method isn’t perfect because the “similar” businesses you reference won’t be a perfect fit and even a single factor can vary pricing quite a bit. However, it’ll still give you a great starting point.
  • Create your own pricing model: This one is likely not realistic for most people but if you have a deep understanding of Excel or programming, it may work for you. With this method, you simply take as much data available as you can and create an algorithm that will help determine pricing for you by weighing in all the different factors. This is actually what we did for our “Suggested Valuation” component in our Live Verification Report: We’ve used data sourced from brokers, publicly available data and resources, as well as proprietary data we have from working with our own clients. The upside with this method is that you can simply plug in the information and get a reliable output each time. Plus, you can gear it toward your own preferences and priorities: For example, if you primarily care about a business’ growth and not necessarily its age, you can factor that into the algorithm. In other words, it wouldn’t just fit a fair market price, but a price you’d be willing to pay. The downside with this method is that you have to constantly update your algorithm to fit current market conditions…and you need a pretty solid programming background (especially if you plan to use some level of Machine Learning to continuously update the algorithm).

Assessing the Website’s Traffic

Since you’re buying an online business, the website’s traffic is a very important component that you don’t want to leave out. For this, we highly recommend having access to something like Google Analytics. Here are a few things you definitely want to look into:

  • Traffic Distribution: For this, you want to see where the website’s traffic is coming from and if there’s an overreliance on a single type of traffic source. If a website relies too heavily on a single type of traffic source, it’s not the worst thing in the world, but there are definitely downsides that you should understand. For example, if a website relies very heavily on organic traffic, a future Google update that negatively impacts the website’s organic traffic could lead to a huge decrease in traffic and revenue. If it relies very heavily on social media traffic, especially if it’s a single social media platform, then an update on “reach” on that platform could have the same impact (which we’ve seen quite a few times in the past, especially with Facebook, Instagram, and Twitter). A huge reliance on paid traffic could result in a negative impact if a large number of new competitors enter the space and start bidding on the same keywords. Ultimately, you want the business to have well-diverisfied traffic distribution so you’re not putting all of your eggs into one basket, so to speak. Will all or even most online businesses have well-diversified traffic sources? No. But that can represent opportunity for you as a new owner.
  • Average Session Duration: This is fairly important as the Average Session Duration (ASD) indicates how long a user stays on the website on average and ultimately how much “attention” the website really garners from visitors. This will vary quite a bit between different business models. For example, an eCommerce website that sells high-end products may have a higher ASD vs. an affiliate website that reviews coffee makers because it typically takes longer to go through the choosing and buying process for a high-end product than reading a review on a coffee maker. So, what are the numbers you should look for? Well, very broadly speaking, we’d suggest the following:
    • < 1 Minute: Below average
    • 1-2 Minutes: Average
    • 2-3 Minutes: Good
    • 3+ Minutes: Excellent
  • Revenue per Visitor (RPV): This metric is calculated by taking the total revenue in a given period and dividing that by the total number of vistiors to the website. RPV indicates how much revenue is generated on average per individual visitor. Higher RPV indicates a strong customer base, higher intent to buy and larger, average cart size. While RPV can be used for any type of sites, it is more insightful for evaluating eCommerce / SaaS sites while Revenue per Mille (which we’ll discuss next) is more useful for content / advertising driven websites. Revenue per Visitor is also a great starting metric when considering ad spend. Because RPV varies so drastically between different websites and industries, it’s quite difficult to provide a benchmark of what’s good a value and what isn’t. So, we’d recommend simply calculating this for websites you’re looking at and using it as a compartive metric, rather than an absolute one.
  • Revenue per Mille (RPM): RPM indicates how much revenue is generated per thousand impressions the site receives. To calculate this, you simply take the total number of impressions in a given period, divide that by the total amount of revenue during that same period, and multiple the outcome by 1000. While Revenue per Mille is utilized for similar analysis as RPV, RPM is a more insightful for content driven sites as it gives a better indication on how well the website’s content or advertisements are doing to monetize visitors / users. Again, we’d recommend simply calculating this for websites you’re looking at and using it as a compartive metric, rather than an absolute one.

A Few Legal Items

We haven’t focused too much on legal due diligence in this checklist, simply because most small business acquisitions have fairly similar legal processes: Sign an LOI, conduct due diligence, sign an APA with an optional non-compete, and boom, you’re done. And the businesses with more complex legal processes, such as validating trademarks, any patents, re-structuring, etc. are far too individual to provide broad advice for. However, there are a few things we’d definitely recommend focusing on:

  • Signing a non-compete agreement: Some brokers will have a non-compete agreement as a requirement others make it optional. Most of the time, we highly recommend having the seller sign a non-compete, which is typically for 3-5 years, but can be longer or shorter. This prevents them from simply turning around and re-building the exact business from scratch again (which would then be competing with your new business).
  • Post-sale training: We also recommend getting terms of training and support in writing, whether that’s in a contract or simply by email. While most sellers are happy to work with buyers to support them in the transition process, it’s always good to concretely establish how much support and training will be provided (e.g. 5 hours of live training through call and screen share and 60 days of email support). This not only ensures that the seller has a legal obligation to provide support after training but also sets expectations very clearly.
  • Supplier agreements. This is primarily for eCommerce acquisitions and while it isn’t always possible, we highly recommend receiving a confirmation from suppliers when possible (or reviewing supplier contracts) to ensure you’ll receive the same rates that the current seller receives for products, especially if they’re grandfathered into a special plan.
  • Asset Purchase Agreement (APA): You’ll likely sign an APA when buying any sort of online business. We highly recommend thoroughly reviewing this and ensuring that the listed assets included in the sale are as comprehensive as possible, with line items for every “asset”. For example, if you’re receiving Facebook, Twitter, and Instagram accounts associated with the business, your best bet is to ensure these are all included as assets. Not only will this ensure there are no confusions during the transfer process, but it will also serve as a great checklist to ensure nothing is missed, which is always helpful as migration processes tend to get a bit hectic.

Some Parting Thoughts

If you’ve managed to complete the due diligence checklist, then congratulations on making it to the finish line! Hopefully, you feel a lot more confident in the business you’re purchasing and more optimistic about its future. Or you’ve found a million things that were wrong and just saved yourself a lot of money and future headache. In either case, if the process was tough to complete, just know that due diligence is a skill that takes time to develop, so you’ll only get better with time. Plus, it’s obviously something you never want to skimp on. Again, we’ve attempted to make this due diligence checklist as thorough as possible but it is targeted for “general” online businesses. So, depending on the business you’re buying, there will likely be other things you want to review and validate from a due diligence perspective.

We hope you found this checklist to be a useful addition to your due diligence repertoire and if there’s anything you feel we missed, let us know in the comments, as we plan to continue updating this list. As always, if there’s anything we can help you with — whether that’s simply answering a question regarding buying online businesses or using our services — don’t hesitate to reach out!

Follow Rapid Diligence:

Rapid Diligence provides comprehensive and data-driven due diligence services for online businesses at every price range. Whether you're ready to close or considering buying an online business, we're here to help!

Leave a Reply

Your email address will not be published.