Guide
Flippa due diligence: what to check before you bid
What to check on a Flippa listing, in the order you can check it. The figures are from our scan of 200 Flippa listings.
What does due diligence on a Flippa listing cover?
Due diligence on a Flippa listing answers four questions before you bid: whether the revenue is real, whether it continues after the sale, whether the site and its code are safe to take over, and who controls the domain and the accounts. Each is checked against a record the seller did not write.
The last two can be read from the web address without the seller knowing. The first two need the seller’s payment and analytics records, read-only.
Start with the address. It needs no permission, and the result is something specific to put to the seller.
How common are problems in Flippa listings?
We scanned 200 businesses listed for sale on Flippa on 4 September 2026, without telling any seller. 184 had at least one finding and 16 were clean. The median site had 3 findings. None of the 558 findings was rated critical, and 193 were rated high.
- 113 sites were not served over HTTPS.
- 27 had an AI endpoint that answered without a login, which bills the owner for usage by strangers.
- 15 returned data from an API route without a login.
The sample is the newest and cheapest listings on Flippa. The study states what the figures do not cover.
What can you check from the URL before you contact the seller?
You can check everything the site serves to an anonymous visitor: whether it uses HTTPS, whether data endpoints answer without a login, whether keys sit in the code the browser downloads, and who holds the domain. F(x) runs 21 of its 35 checks from the address alone. It is free and needs no account.
A check that cannot run is reported as could not run, never as a pass. In the study the check for forgotten staging and preview sites still live could not run on 132 of 200 sites.
Scan a listing before you message the seller.
How do you verify the revenue on a Flippa listing?
Revenue is verified when it is read from the payment processor’s own records. A screenshot is the seller’s copy of them. Ask the seller for read-only access, then check three things: how much revenue sits on a discount that ends, how much traffic is paid for, and how many subscribers never log in.
F(x) sends the seller one request and can read Stripe, Paddle, Shopify, Google Analytics, GitHub and Supabase. It requests no write, refund or admin scope, and the access is discarded when the scan ends. The seller can refuse any tool, and the report records which they refused and any reason they gave.
3% of the 200 Flippa listings we sampled showed revenue Flippa itself had verified. The other 194 are asking you to take the screenshot on trust. (F(x) · 200 listings, July 2026)
That figure is from the listings themselves. The scan read public addresses only, and no seller was asked for access. Pricing says when the seller-data scan is charged.
What do you do with a finding?
A finding changes the terms of the offer. The usual moves are to have the seller fix it before close, reduce the price by the cost of the fix, hold part of the price in escrow, or walk away. In our study the median cost to fix one site’s findings was $300 to $975.
That range is engineering time, from a documented model that has not been tuned against real invoices. Use it to rank findings against each other.
An F(x) report gives each finding a dollar range and names one of these moves beside it.
Run the URL scan
Paste the address of the listing. 21 checks run from it, free, with no account.