Due diligence before buying a small online business

A quick disclaimer before anything else: this is general education about the kinds of things a buyer checks before acquiring a small online business, not financial, legal, or tax advice, and any real transaction deserves professionals who can look at the specifics. With that said, buying an existing small online business — a content site, a small store, a niche tool, a newsletter — is one of the more accessible ways to acquire cash flow rather than build it from zero, and it can be either a genuinely smart move or an expensive education. What mostly decides which one you get is not negotiation skill or luck; it is the unglamorous work you do before any money changes hands, the process known as due diligence.

The mindset to bring is that a listing is a sales pitch, written to present the business in its best light, and your job is not to assume it is dishonest but to confirm what is true, surface what was conveniently omitted, and judge whether the thing being sold will still be standing once the current owner walks away. That last point is the one beginners most often miss: a business can be perfectly real and perfectly profitable today and still be a bad purchase if its profitability depends on something that leaves with the seller. This article walks through the main areas a careful buyer examines — verifying the numbers, finding the hidden concentration risks, testing transferability, and recognising the red flags that should end a conversation.

Everything in due diligence flows from one honest premise: the seller knows more about the business than you do, and the listing reflects what they chose to show. This is not an accusation of fraud — most sellers are honest — but even an honest seller naturally frames things favourably, leads with the best months, describes the workload as lighter than it feels, and is not eager to volunteer the weaknesses. The information asymmetry is structural, and the entire purpose of diligence is to close it: to move from "here is what the seller says" to "here is what I have independently confirmed," and to make your decision on the second, not the first.

That reframing changes how you read every claim. A revenue figure is a hypothesis to verify, not a fact to accept. A traffic chart is an invitation to look at the underlying analytics yourself, not a conclusion. "Runs itself in a few hours a week" is a question to test, not a feature to value. None of this requires treating the seller as an adversary; the good ones expect and respect a thorough buyer, and a seller who resists reasonable verification is itself one of the most useful signals you can get. The buyer’s discipline is simply to trust nothing that can be checked until it has been checked.

The number that sets the price is the profit, so it is the number to verify most rigorously, and the rule is to insist on primary sources rather than anything the seller could have edited. A screenshot of a dashboard or a spreadsheet typed up by the owner is a starting point for conversation, not evidence; what you want is the underlying record straight from the source — the actual payment-processor and platform reports, account statements, and tax filings, ideally accessed live with the seller rather than received as files. When a business genuinely earns what it claims, that money left a trail in systems the seller does not control, and matching the claimed revenue to that independent trail is the core of financial diligence.

Look not just at the total but at its shape and its honesty. Pull the revenue month by month over a meaningful span so you can see seasonality, trend, and any one-off spikes that should not be valued as recurring. Scrutinise the expenses with equal care, because profit is revenue minus costs and sellers sometimes present a flattering profit by quietly omitting real expenses — their own labour, software subscriptions, contractor payments, returns and refunds. The figure you ultimately price against is the genuine, sustainable profit a new owner would actually keep after every real cost, which is often lower than the headline, and reading the financials carefully enough to find that true number is exactly the skill of reading a P&L.

For most online businesses, traffic is the engine under the revenue, so verifying it is as important as verifying the money, and again the watchword is primary sources. Rather than accept exported charts, get read access to the actual analytics and, for a search-dependent business, the search console, so you are looking at the real data in the real tools. You are checking two things: that the volume is genuinely what was claimed, and — just as important — that it is real, engaged human traffic rather than a flattering number inflated by bots, paid spikes, or a single viral fluke that has already faded. A business with half the claimed traffic, or traffic that does not convert, is a different and cheaper business than the one in the listing.

The deeper question is where the traffic comes from, because the composition of the sources tells you how durable and how transferable it is. Traffic concentrated in a single source is fragile: a site that gets nearly all its visitors from one search engine’s rankings lives or dies by an algorithm it does not control, and one that depends on a single social platform or the founder’s personal audience may not survive the channel changing or the founder leaving. A healthier picture is a spread of sources — some search, some direct, some referral, some email — so that no single channel’s bad week is an extinction event. Map the sources before you value the traffic, because two businesses with identical visitor counts can carry wildly different risk depending on where those visitors originate.

The most dangerous risks in a small business are usually not visible in the headline figures; they hide in concentration — an over-reliance on a single point of failure that looks fine right up until it fails. Revenue concentration is the classic case: a store where one product drives most of the sales, or a service business where one or two clients are most of the revenue, is one product trend or one lost client away from a very different income statement. Customer concentration, supplier concentration, and channel concentration are all variants of the same hazard, and a thorough buyer goes looking for them precisely because the seller’s summary numbers smooth them over.

Platform concentration deserves its own attention because it is so common online and so easy to underweight. A business built on top of a marketplace, a search engine, an app store, or a social platform is, to some degree, a tenant on land it does not own, subject to rule changes, fee increases, ranking shifts, and account suspensions that can erase value overnight regardless of how well the business is run. This does not make such businesses uninvestable — many good ones depend on platforms — but it means the platform dependency is a central risk to price in, not a footnote, and that you should understand exactly how exposed the business is and how it would fare if the platform turned hostile. The general rule of diligence is to ask, for each engine of the business, "what single thing could break this," and to make sure you are comfortable owning every answer.

You are not really buying past performance; you are buying the future performance you can produce after the seller is gone, which makes transferability the single most decisive question in the whole process. A business can be genuinely profitable and still be a poor purchase if its results depend on assets that walk out the door with the current owner — their personal reputation and relationships, their undocumented knowledge, their face on the brand, their handshake deals with suppliers. The careful buyer interrogates how much of the business’s success lives in the owner as a person versus in the systems, assets, and processes that would come with the sale, because only the latter is what you actually get.

Concretely, that means checking that the transferable pieces really transfer. Will the domain, the content, the customer list, the social accounts, the supplier agreements, and the operational know-how actually convey to you, cleanly and legally — or are some of them tied to the seller’s personal accounts, identity, or relationships in ways that do not move? A business documented well enough that a new owner can run it, with assets that are genuinely assignable and a customer base loyal to the brand rather than the person, transfers well. A business that is really one talented individual plus a website may evaporate the moment that individual leaves, no matter how good its recent numbers were. Test the handover before you trust the history.

Some findings are not prices to negotiate but reasons to walk, and recognising them protects you from talking yourself into a bad deal because you have already invested time. The brightest red flag is a seller who resists reasonable verification — who offers only screenshots, refuses live access to the real accounts, or grows evasive when you ask to confirm the basics. An honest business with honest numbers has nothing to hide from a buyer’s read access, so reluctance to provide it is information in itself. Close behind are numbers that do not reconcile: revenue that does not match the payment processor, traffic that does not match the analytics, expenses that seem implausibly low for the work involved.

Other red flags are about the durability and legitimacy of the business rather than the honesty of the seller. A sharp, unexplained decline in recent traffic or revenue — especially one the seller is conspicuously not discussing — may be the real reason it is for sale, and you should assume the trend continues unless you can prove otherwise. So should any sign that the traffic was won through tactics that invite a penalty, that the revenue leans on a single fragile channel, or that the business operates in a grey area of a platform’s rules or the law. None of these guarantees disaster, but each one shifts the burden heavily onto the seller to explain, and a deal that requires you to assume the best about several of them at once is usually a deal to decline. The buyer’s edge is the willingness to walk away, and due diligence is what tells you when to use it.

Diligence is not a pass/fail exam; it is the research that informs two linked decisions — whether to buy at all, and if so, at what price and on what terms. Most findings are neither dealbreakers nor non-events but adjustments: a verified-but-lower true profit lowers the value, a heavy platform dependency warrants a lower multiple for the added risk, a strong spread of traffic sources and clean transferability can justify paying toward the top of a fair range. The point of all the checking is to replace the seller’s optimistic story with your own evidence-based one, and then to let that story, not the asking price, anchor what you are willing to pay. Valuation and diligence are two halves of the same judgement.

Terms can also turn a risky deal into an acceptable one, which is why diligence findings should shape the structure of the purchase and not just the headline number. Where transferability or trend is uncertain, structures that keep some of the seller’s outcome tied to the business’s performance after the sale, or that secure a real handover and training period, share the risk more fairly than paying everything up front against an unverified future. The broad lesson for a first-time buyer is the same one that runs through all of this: the money is made in the buying, in the discipline of verifying what is real, pricing what is risky, and being willing to walk from what does not hold up. Do that work, lean on professionals for the legal and financial specifics, and an acquisition becomes a calculated decision rather than a hopeful bet — which is exactly what it should be.