Guide
Website due diligence checklist
The checks to run before you buy a website, grouped by what each one protects, and the record that answers it. Figures are from our scan of 200 Flippa listings.
What should a website due diligence checklist cover?
Five areas: the revenue, the traffic, the code and its security, who controls the domain and accounts, and the seller’s own conduct during the sale. A listing describes each in the seller’s words. The checklist replaces each description with a record you can read yourself, or with the seller’s refusal to show one.
The sections below take them in the order you can check them: the public ones first, then the ones that need the seller.
What can you check before you contact the seller?
Everything public: whether the site is served over HTTPS, whether data endpoints answer without a login, whether keys sit in the code sent to every visitor, and when the domain and certificate expire. In our study 184 of 200 Flippa listings had at least one finding of this kind.
The 21 public checks F(x) runs from the address alone:
- HTTPS and certificate validity
- Environment file left on the server
- Git repository served to the public
- Browser security headers
- Original source code published with the app
- Folders browsable by anyone
- Default admin pages still reachable
- Dependency manifest served publicly
- Who other sites are allowed to read from this one
- Insecure resources loaded on a secure page
- Session cookie protection
- Hallucinated and typosquatted dependencies
- Forgotten staging and preview sites still live
- Secrets in archived copies of the site
- Who holds the domain, DNS, hosting and email
- API keys shipped inside the browser bundle
- Unprotected AI endpoints anyone can run up a bill on
- Buttons and features that do nothing
- Data endpoints open without signing in
- Firebase database readable by the world
- Supabase tables readable with the public key
Scan a listing to run all of them, free.
How do you check the revenue?
Read it from the payment processor. A screenshot or a spreadsheet is a copy the seller made. Ask the seller for read-only access to Stripe, Paddle or Shopify, then compare the committed monthly revenue against the figure in the listing, and look for discounts that expire, refunds, and revenue resting on one customer.
3% of the 200 Flippa listings we sampled showed revenue Flippa itself had verified. The other 194 are asking you to take the screenshot on trust. (F(x) · 200 listings, July 2026)
How to check a website’s revenue covers each of these in detail.
How do you check the traffic?
Ask for read-only access to the analytics account and split the visits by source. Traffic from paid ads stops when the ad spend stops, so check whether the ad account is part of the sale. Search and direct visits stay with the site. Compare the split against what the listing claims.
The F(x) checks that read the analytics account:
- How much of the traffic is bought
- Subscribers who pay but never use it
How do you confirm who controls the domain and accounts?
Look up the domain’s registrar, expiry date, DNS provider and email provider in the public records, then ask the seller to list every account the business runs on. Agree in writing who renews the domain before completion, and move each account into your name before the money is released.
The free domain check reads the registrar, the expiry date and the providers for any domain.
A lapsed domain is not lost at once. ICANN requires registries to offer a 30-day Redemption Grace Period after deletion, during which the registrar can restore it. After that it can be registered by anyone.
Run the URL scan
Paste the address of the listing. 21 checks run from it, free, with no account.