The due diligence checklist to run before you buy.
A listing description tells you what a seller wants you to know. Due diligence is how you find out what's actually true before your money moves. Here's exactly what to check, in order.
Bottom line:Verify revenue and traffic through direct, read-only access to real dashboards — never screenshots alone. Check code and asset ownership before paying. Use escrow so your payment isn't released until you've actually received and confirmed the asset.
Revenue claims are the single most important thing to verify, and the easiest to misrepresent with cropped screenshots. Insist on direct access wherever possible.
Read-only access to the actual payment processor (Stripe, PayPal) or ad network dashboard — not exported PDFs or screenshots
At least 6–12 months of trailing history, not a single best month
Bank or PayPal deposit records that reasonably match the reported revenue
A clear breakdown of revenue by source (subscriptions, one-off sales, ads, affiliate) rather than one lump number
Recurring costs — hosting, tools, contractors, ad spend — subtracted to see real net profit, not just gross revenue
Verifying traffic
Traffic screenshots are trivially easy to fake or cherry-pick. Direct dashboard access is the only reliable way to confirm what a listing claims.
Read-only access to Google Analytics or Search Console, not a screenshot of a single chart
A trend view over 6–12 months, to catch decline that a single snapshot would hide
Traffic source breakdown — organic search, direct, social, referral, paid — to see how diversified it is
Confirmation that traffic isn't a temporary spike from a one-off viral post or press mention
For SEO-driven sites, a look at core keyword rankings to sanity-check that they're not about to drop
Technical and code review
For apps, SaaS products, and anything with a codebase, a technical review can save you from inheriting a rebuild disguised as a purchase.
Repository access to review code quality, structure, and how recently it's been maintained
Dependency versions — heavily outdated frameworks or libraries can mean near-term rework
Whether the app has any automated tests, and what deployment looks like
Any third-party services or APIs it depends on, and what happens if those change pricing or shut down
Documentation — or the lack of it — since undocumented code costs you ramp-up time after the sale
If you're not technical yourself, it's worth paying a developer for an hour or two of review before a larger purchase — cheap insurance against a much bigger mistake.
Ownership and transferability
A great business is worth nothing if you can't actually take ownership of it cleanly. Confirm the mechanics before you commit.
Domain registrar access and confirmation the seller actually controls the domain (WHOIS lookup)
Clear plan for transferring hosting, code repositories, and any third-party accounts (payment processor, email service, analytics)
For SaaS: how existing customer subscriptions and billing will transfer without disruption
For content sites: confirmation the seller owns the content outright, not licensed or ghostwritten under terms that don't transfer
No pending legal disputes, trademark issues, or platform violations tied to the asset
Vetting the seller
The asset isn't the only thing worth checking — the person selling it matters too.
Account history and how long the seller has been active on the platform
Reviews or transaction history from previous sales, if available
Willingness to answer detailed questions without getting defensive or evasive
A believable, specific reason for selling — vague or inconsistent answers are worth probing
Red flags that should stop a deal
Any one of these alone might have an innocent explanation. More than one together is a strong signal to slow down or walk away.
Refusal to provide direct, read-only access to analytics or revenue dashboards
Financial figures that don't reasonably match deposit or bank records
Pressure to close quickly, skip verification steps, or pay outside of escrow
A brand-new seller account with no history, especially for a high-priced listing
Revenue that's heavily concentrated in one client, platform, or traffic source with no explanation of the risk
Vague, shifting, or inconsistent answers to direct questions
This is exactly what escrow-protected checkout is for: even after due diligence, your payment stays held until you've actually received the asset and confirmed it matches what was promised. See Buyer Protection for how that works on Siterifty.
Due diligence FAQ
How do I verify a website's traffic before buying it?
Ask for read-only access to Google Analytics or Search Console rather than screenshots. Review trends over 6–12 months and check whether traffic comes from multiple sources.
How do I verify a website's revenue before buying it?
Request read-only access to the actual payment processor or ad network dashboard, and cross-check against bank or PayPal deposit history where possible.
What are the biggest red flags when buying a website or app?
Reluctance to share direct verification access, figures that don't match deposit records, a brand-new seller account, pressure to skip escrow, and heavy dependence on a single traffic source or client.
Should I use escrow when buying a website?
Yes — escrow holds your payment until the asset is transferred and confirmed received, protecting you from paying and receiving nothing, and protecting the seller from delivering and not getting paid.
Ready to start vetting a real listing?
Every deal on Siterifty runs through escrow-protected checkout, and delivery happens inside a timestamped deal chat — not over email.
This checklist covers due diligence steps for buying a website, app, or SaaS product: verifying financials through direct read-only access to payment processors rather than screenshots, verifying traffic through Google Analytics/Search Console access, reviewing code and technical debt, confirming ownership and transferability of domains and accounts, and vetting the seller's history.
It lists common red flags — refusal to provide verification access, figures that don't match deposit records, pressure to skip escrow — and recommends escrow-protected payment as a final safeguard, which is how transactions work on Siterifty, a marketplace for indie developers buying and selling digital products.
Due Diligence Checklist — Before You Buy a Website or App | Siterifty
