What is the most important thing to verify when buying an eCommerce store?

Gross margin is the single most important financial metric to verify independently. Revenue figures are easy to present attractively; gross margin (Revenue minus COGS) is where eCommerce stores most often overstate profitability. Common manipulation patterns: (1) understating COGS by excluding shipping from supplier, import duties, or packaging; (2) presenting gross margin before returns, which can reduce effective margin by 5–15 percentage points in high-return categories; (3) cherry-picking a TTM period that excludes high-COGS months (typically Q4 when shipping surcharges peak). Always verify COGS via supplier invoices and cross-reference against Shopify COGS reports or the accounting software. After margin, verify that the primary customer acquisition channel (paid ads, SEO, or email) is transferable and will not lose significant performance during the ownership transition.

Do I need technical skills to do eCommerce due diligence?

No coding skills are required, but platform familiarity with Shopify or WooCommerce is helpful. The most technically demanding steps are: (1) reviewing app integrations and their transfer eligibility — this requires navigating Shopify admin or WooCommerce settings and reading API documentation summaries; (2) ad account audit — reviewing Google Ads or Meta Ads campaign structure requires familiarity with those platforms. Everything else — revenue verification, gross margin calculation, supplier concentration analysis, customer retention metrics — requires only basic spreadsheet skills and systematic access requests. For acquisitions above $150,000, hiring an eCommerce specialist to perform a technical review ($500–$1,500) is a reasonable insurance investment.

How long does eCommerce due diligence take?

For a standard eCommerce acquisition ($20,000–$150,000), plan for 2–3 weeks of active due diligence after all accesses are granted. Revenue and platform verification (3–4 days), gross margin and COGS analysis (2–3 days), supplier and inventory review (2–3 days), ad account audit (1–2 days), customer retention and email analysis (1–2 days), legal and compliance review (2–3 days), and transfer planning (1–2 days). The most time-consuming step is typically supplier verification — obtaining purchase orders, verifying MOQs, and confirming supplier willingness to continue with a new owner can take longer than expected. Budget additional time if the store sells in regulated product categories or uses complex multi-channel inventory systems.

What eCommerce due diligence red flags should cause me to walk away?

Walk away if you find: (1) Gross margin that cannot be reconciled with supplier invoices — if the stated margin is 45% but invoices imply 28%, the financial foundation of the acquisition is wrong. (2) A Shopify Payments account as the sole payment processor with no Stripe alternative — Shopify Payments approval for the new owner is not guaranteed and can take weeks; being stuck with no way to accept payment post-acquisition is a critical operational risk. (3) More than 60% of revenue from a single paid traffic channel (Google Shopping or Meta) with no organic baseline — paid traffic can be paused, banned, or algorithmically disrupted. (4) An Amazon Seller Central account with unresolved account health issues, active ASIN suspensions, or an A-to-Z guarantee claim rate above 1% — Amazon can suspend the entire account if metrics deteriorate. (5) COGS that include no shipping cost, duty, or packaging — these are always real costs; their absence from the calculation means the SDE is materially overstated.

eCommerce Due Diligence Checklist

A complete 8-area due diligence framework for evaluating an eCommerce store before acquisition. Use this alongside the general website due diligence guide and the website acquisition checklist. eCommerce acquisitions require particular attention to gross margin verification, inventory valuation, supplier concentration, platform transfer complexity, and paid traffic channel transferability — risks that general checklists underweight.

1.Financial due diligence: revenue, SDE, and gross margin

Request read-only access to Shopify, WooCommerce, or the platform's analytics dashboard — verify total revenue and order count for the trailing 24 months to identify trends, seasonality, and any one-time spikes
Cross-reference platform revenue against bank statements — confirm that cash deposits match net revenue after payment processing fees (Shopify Payments charges 2.4–2.9%; Stripe charges 2.9% + $0.30)
Calculate gross margin for each major product or SKU group: (Revenue − COGS) ÷ Revenue — confirm this matches the seller's stated gross margin; a margin discrepancy of more than 5 points requires explanation
Request a full cost of goods breakdown: product cost, shipping from supplier, import duties, and any packaging costs — verify these against purchase orders and supplier invoices
Verify the SDE calculation: platform revenue minus COGS, shipping costs, returns, platform fees, ad spend, apps/subscriptions, and any contractor or VA costs; add back owner salary if applicable
Identify all add-backs claimed by the seller to increase SDE — non-recurring expenses (one-time marketing pushes, equipment purchases) are legitimate; ongoing operational costs are not
Check for inventory in transit at time of acquisition — inventory ordered but not yet received adds cost that may not appear in the trailing 12 months of financials but will be required to fulfil upcoming orders
Request the trailing 24-month revenue breakdown by month — identify seasonal patterns, growth trajectory, and any months with unusually high or low revenue that would distort the TTM figure

2.Traffic and marketing channel verification

Request read-only access to Google Analytics 4 — verify monthly sessions, traffic sources, conversion rate, and top traffic channels for the trailing 24 months
Confirm the primary customer acquisition channels: organic search, Google Shopping ads, Meta ads, email marketing, TikTok, or marketplaces — identify what percentage of revenue depends on each channel
For paid traffic channels (Google Ads, Meta): request the ad account performance dashboard — verify ROAS (Return on Ad Spend) history and confirm that profitable ROAS is achievable after ownership transfer; note that ad performance often drops 20–40% during account transitions
Request read-only Google Ads and Meta Ads account access — review campaign structure, audience targeting, and creative assets; confirm the ad accounts can be transferred or that the seller will assist in rebuilding campaigns
Verify the email list size and recent campaign performance — request Klaviyo, Mailchimp, or equivalent dashboard access showing open rates, click rates, and revenue attributed to email automation sequences
For SEO-dependent stores: cross-reference GA4 organic traffic against Google Search Console and an Ahrefs or Semrush estimate — significant divergence above 25% requires investigation
Check for any paid traffic dependency risk: if more than 50% of revenue comes from paid ads, model the business at break-even ROAS — a new owner losing ad account access or experiencing a learning period could temporarily eliminate profitability
Verify social media following and engagement rates for all platforms included in the sale — confirm follower counts, recent engagement rates, and that accounts are owned by the business entity rather than the seller's personal profile

3.Inventory and product due diligence

Request a full inventory count by SKU with current stock levels and reorder points — confirm whether inventory is included in the asking price or priced separately at cost
Verify inventory at 3PL or Amazon FBA: request a warehouse inventory report or FBA inventory dashboard screenshot showing units on hand, units in transit, and stranded inventory
Calculate the inventory turn rate: annual COGS ÷ average inventory value — a turn rate below 4× for a physical goods business indicates slow-moving inventory that may need to be discounted post-acquisition
Review the return rate by product: request the returns data broken down by SKU — a return rate above 20% for any high-revenue SKU signals quality or description issues; high returns also inflate gross revenue while suppressing net revenue
Verify supplier agreements and minimum order quantities (MOQs) — confirm you can place orders at the same terms the seller negotiated; preferred pricing is often tied to the seller's personal relationship with the supplier
Identify single-SKU or single-category concentration — if more than 50% of revenue comes from one product, the business is exposed to supplier, competitor, and trend risk; request 24-month revenue by SKU
For seasonal businesses: verify that inventory levels at time of acquisition reflect the upcoming season's demand rather than the prior season's leftover stock; buying at peak season means inheriting inventory costs with compressed sales window
Check for expired, obsolete, or damaged inventory in the stock count — request photos or a third-party inventory audit for acquisitions above $50,000 to verify that stated inventory is sellable at stated value

4.Platform and technology due diligence

Confirm the eCommerce platform (Shopify, WooCommerce, BigCommerce, custom) and the transfer process — Shopify stores transfer via the Shopify Partner program (store ownership transfer within the Shopify ecosystem); WooCommerce transfers via hosting and domain migration
For Shopify stores: verify whether the store uses Shopify Payments — Shopify Payments accounts are tied to the seller's legal entity and cannot be transferred; you must create a new Shopify Payments account, which requires underwriting approval and typically takes 5–14 business days
Request the full list of installed Shopify apps, plugins, or WooCommerce extensions with their monthly costs — common Shopify app subscriptions (Klaviyo, ReCharge, Gorgias, Yotpo, Bold) add $200–$1,000/month to operating costs that may be understated in the SDE calculation
Verify that all third-party integrations (ERP, 3PL software, inventory management, accounting) have clear transfer or re-setup paths — enterprise integrations built by the seller or a custom developer may require significant post-acquisition engineering work
Check whether any custom code, apps, or integrations were built by a developer who is no longer available — request the codebase or configuration files for any custom-built functionality, along with documentation
Verify ad account structure and pixel data: confirm the Facebook Pixel, Google Tag Manager, and GA4 conversion tracking are properly configured and that the seller's pixel data (which trains ad algorithms) can be shared or transferred
Confirm payment gateway accounts and their transfer eligibility: Stripe accounts can be transferred; PayPal Business accounts are typically tied to the seller's identity and require a new account; Square requires a new merchant account
Request the domain transfer process: obtain the EPP/auth code before releasing escrow; confirm the domain is not in a registrar lock and has more than 6 months before expiry

5.Supplier and supply chain due diligence

Request the complete supplier list with product categories, country of origin, lead times, and minimum order quantities — verify that no single supplier accounts for more than 40% of COGS
Obtain copies of supplier agreements or purchase order terms — confirm that supplier pricing and terms apply to the business entity, not to the seller personally; many small eCommerce businesses operate on informal purchasing terms that may not transfer
For China-based suppliers: verify whether any products are subject to Section 301 tariffs (25–100% on certain categories) or affected by import restrictions — confirm current duty rates and whether they are included in the stated COGS
For Amazon FBA sellers: request access to the Amazon Seller Central account dashboard — verify BSR (Best Seller Rank) trends, account health metrics, and any active account restrictions, A-to-Z claims, or product listing suspensions
Verify product compliance and certifications: for electronics, children's products, food, supplements, or cosmetics — confirm CE marking, FCC certification, FDA registration, or other applicable compliance documents are current and transferable
Check for supplier exclusivity or geographic restrictions — some suppliers grant exclusivity for product categories to specific buyers; exclusivity that is tied to the seller's entity may lapse post-acquisition
Calculate supplier lead times and their impact on working capital: if a supplier has a 90-day lead time and requires 50% deposit, model the cash required to maintain inventory levels under new ownership
Assess geographic supply chain concentration risk: if all products ship from a single factory in one country, evaluate the impact of port disruptions, tariff changes, or geopolitical events on the supply chain

6.Customer base and retention due diligence

Request the customer repeat purchase rate (RPR): the percentage of customers who made a second purchase within 12 months — an RPR above 30% indicates strong product-market fit and a loyal customer base; below 15% suggests the store relies entirely on new customer acquisition
Verify the average order value (AOV) trend over 24 months — a declining AOV alongside stable revenue may indicate a shift toward lower-margin products or increasing discount dependency
Identify customer concentration risk: request a breakdown showing the percentage of revenue from the top 1%, 5%, and 20% of customers — a B2B-adjacent eCommerce store where 5 customers represent 40% of revenue is more fragile than a broad consumer base
For subscription or replenishment eCommerce: request the active subscription count, monthly subscriber churn rate, and reactivation rate — compare against the LTV calculation to verify the acquisition price
Review customer review profile: request the Amazon, Google, Trustpilot, or Shopify review data — check for any sudden drops in average rating (may indicate product quality issues), review velocity, or patterns of incentivized reviews
Verify that customer email list ownership is explicit — confirm the list is owned by the business entity and can be transferred; GDPR and CCPA compliance requires that opt-in consent was collected and is documented
Request the refund and chargeback rate: a chargeback rate above 1% is a risk signal for payment processor account health; Stripe and PayPal can terminate merchant accounts for sustained chargeback rates above 1.5%
Identify any customer loyalty programs, gift cards, or store credits outstanding at closing — these represent liabilities that the buyer inherits and must honour; they should be disclosed in the asset purchase agreement

7.Legal and compliance due diligence

Verify that all product trademarks, brand names, and logos are registered to the business entity being sold — request USPTO or international trademark registration certificates; a brand operating without trademark registration is vulnerable to brand jacking post-acquisition
Confirm that the business holds the necessary business licences, sales tax registrations (Nexus states), and any required reseller certificates — verify that sales tax collection is in compliance with the seller's established Nexus states
For any products in regulated categories (supplements, cosmetics, electronics, children's products): request FDA registration, FCC certification, ASTM compliance, or other applicable documentation — unresolved compliance gaps create liability transferable to the buyer
Review the Terms of Service, Returns Policy, and Privacy Policy — confirm they comply with applicable law (FTC rules on return policies, GDPR if selling to EU customers, CCPA if selling to California residents)
Verify Amazon TOS compliance for FBA sellers: request confirmation that the account has no active policy violations, no product listing suspensions in the past 12 months, and no pending account review — Amazon account suspensions can be catastrophic and are difficult to reverse
Check for any outstanding product liability claims, customer lawsuits, or regulatory actions — request a seller disclosure statement and confirm via the asset purchase agreement that the seller indemnifies the buyer for pre-closing liabilities
Verify customs and import compliance: confirm that all imported products clear customs with proper HS codes, that declared values match actual transaction values, and that no customs bonds or prior violations exist
Review active contracts, subscriptions, and services for any change-of-control clauses — some software licences, wholesale agreements, or service contracts automatically terminate or require consent when ownership changes

8.Transfer planning and handover checklist

For Shopify stores: initiate the store transfer via the Shopify Partners dashboard — the seller invites the buyer as a co-owner, then transfers store ownership; ensure this step is completed before escrow release
Transfer or recreate payment processing accounts: if Shopify Payments is used, the buyer must apply for their own Shopify Payments account before the store transfer; if Stripe, initiate a Stripe account transfer via Stripe Support (requires Stripe's involvement)
Transfer ad accounts: for Google Ads, the seller grants manager access to the buyer's MCC; for Meta, the business manager and ad accounts are transferred via business settings; ensure conversion pixel data is shared, not just campaign access
Inventory handover: for 3PL-managed inventory, arrange a formal inventory transfer by notifying the 3PL in writing of the ownership change; for FBA inventory, arrange an Amazon Seller Central sub-account or account ownership transfer with Amazon Seller Support
Confirm domain and hosting transfer: obtain the EPP/auth code for domain transfer to the buyer's registrar; arrange for hosting account transfer or migration; update DNS records only after the new hosting is verified working
Transfer email marketing platform: Klaviyo, Mailchimp, and most ESPs allow account ownership transfer; confirm the subscriber list, automation flows, and template library transfer to the buyer's account before the seller's account access is revoked
Transfer Google Analytics 4 and Search Console: seller must add buyer as admin to both properties; confirm historical data retention in GA4 after the seller removes their own admin access; do not allow seller to delete any data or properties before transfer
Negotiate a 30–60 day transition support period covering: supplier introductions, ad campaign briefings, customer service handover, platform-specific questions, and access to any vendor or partner relationships the seller maintains personally

Key eCommerce due diligence benchmarks

Gross margin

Good: Over 40% (physical goods)

Caution: 25–40%

Red flag: Under 25% — thin margin risk

Repeat purchase rate

Good: Over 30% within 12 months

Caution: 15–30%

Red flag: Under 15% — acquisition-dependent

Single-supplier COGS share

Good: Under 30% from one supplier

Caution: 30–50%

Red flag: Over 50% — concentration risk

Paid traffic revenue share

Good: Under 30% from paid ads

Caution: 30–60%

Red flag: Over 60% — channel dependency

Return rate

Good: Under 10%

Caution: 10–20%

Red flag: Over 20% — quality or description issues

Chargeback rate

Good: Under 0.5%

Caution: 0.5–1.0%

Red flag: Over 1.0% — payment processor risk

Frequently asked questions

What is the most important thing to verify when buying an eCommerce store?: Gross margin is the single most important financial metric to verify independently. Revenue figures are easy to present attractively; gross margin (Revenue minus COGS) is where eCommerce stores most often overstate profitability. Common manipulation patterns: (1) understating COGS by excluding shipping from supplier, import duties, or packaging; (2) presenting gross margin before returns, which can reduce effective margin by 5–15 percentage points in high-return categories; (3) cherry-picking a TTM period that excludes high-COGS months (typically Q4 when shipping surcharges peak). Always verify COGS via supplier invoices and cross-reference against Shopify COGS reports or the accounting software. After margin, verify that the primary customer acquisition channel (paid ads, SEO, or email) is transferable and will not lose significant performance during the ownership transition.
Do I need technical skills to do eCommerce due diligence?: No coding skills are required, but platform familiarity with Shopify or WooCommerce is helpful. The most technically demanding steps are: (1) reviewing app integrations and their transfer eligibility — this requires navigating Shopify admin or WooCommerce settings and reading API documentation summaries; (2) ad account audit — reviewing Google Ads or Meta Ads campaign structure requires familiarity with those platforms. Everything else — revenue verification, gross margin calculation, supplier concentration analysis, customer retention metrics — requires only basic spreadsheet skills and systematic access requests. For acquisitions above $150,000, hiring an eCommerce specialist to perform a technical review ($500–$1,500) is a reasonable insurance investment.
How long does eCommerce due diligence take?: For a standard eCommerce acquisition ($20,000–$150,000), plan for 2–3 weeks of active due diligence after all accesses are granted. Revenue and platform verification (3–4 days), gross margin and COGS analysis (2–3 days), supplier and inventory review (2–3 days), ad account audit (1–2 days), customer retention and email analysis (1–2 days), legal and compliance review (2–3 days), and transfer planning (1–2 days). The most time-consuming step is typically supplier verification — obtaining purchase orders, verifying MOQs, and confirming supplier willingness to continue with a new owner can take longer than expected. Budget additional time if the store sells in regulated product categories or uses complex multi-channel inventory systems.
What eCommerce due diligence red flags should cause me to walk away?: Walk away if you find: (1) Gross margin that cannot be reconciled with supplier invoices — if the stated margin is 45% but invoices imply 28%, the financial foundation of the acquisition is wrong. (2) A Shopify Payments account as the sole payment processor with no Stripe alternative — Shopify Payments approval for the new owner is not guaranteed and can take weeks; being stuck with no way to accept payment post-acquisition is a critical operational risk. (3) More than 60% of revenue from a single paid traffic channel (Google Shopping or Meta) with no organic baseline — paid traffic can be paused, banned, or algorithmically disrupted. (4) An Amazon Seller Central account with unresolved account health issues, active ASIN suspensions, or an A-to-Z guarantee claim rate above 1% — Amazon can suspend the entire account if metrics deteriorate. (5) COGS that include no shipping cost, duty, or packaging — these are always real costs; their absence from the calculation means the SDE is materially overstated.

Related guides

Ready to browse eCommerce stores for sale?

Browse active eCommerce listings with verified revenue, traffic, and pricing data. No broker fees.

Browse eCommerce stores Sell your store

Buy sites direct. No middleman.

Browse profitable websites and apps. Contact sellers directly. No fees, no commissions, no one taking a cut.

Zero broker feesDirect seller contactNo commissions