1. Skipping due diligence because the listing looks convincing

The most expensive mistake in website acquisitions is treating a compelling listing as a substitute for verification. A listing is a sales document — it shows the site in its best light. Due diligence is how you find out what the listing does not tell you.

Specific patterns to watch for: a seller who creates urgency (“I have two other interested buyers”), one who discourages independent traffic verification, or one who provides screenshots instead of live read-only analytics access. These are not reasons to move faster — they are reasons to slow down.

The due diligence guide covers the full verification process. The acquisition checklist gives you a step-by-step checklist you can work through before releasing any funds.

2. Accepting screenshots instead of live analytics access

Screenshots of Google Analytics, revenue dashboards, or payment processor summaries can be edited. Always request read-only access to the live accounts: Google Analytics 4, Google Search Console, and payment processor reporting (Stripe, PayPal, Gumroad, etc.).

In GA4, look for: sessions with 100% bounce rate from suspicious geographies, direct traffic spikes with no referral source, very high session volume with near-zero time on page (bot traffic), and large discrepancies between reported clicks in Search Console and organic sessions in Analytics.

Use a third-party tool like Ahrefs or Semrush to independently estimate organic traffic and compare against what the seller shows you. A site claiming 50,000 monthly visitors where Ahrefs estimates 8,000 requires an explanation. See the analytics and traffic data guide for a full verification checklist.

3. Buying on trailing earnings without understanding the trend

A site's trailing twelve months (TTM) SDE is the standard basis for valuation — but a site earning $3,000/month last month and $3,000/month a year ago is a very different asset from one earning $3,000/month last month but $5,000/month a year ago. The second site is in decline, and you should not pay the same multiple for it.

Always request at least 24 months of monthly revenue and traffic data. Calculate year-over-year growth to separate seasonality from actual trend. A site with declining YoY metrics for two consecutive years should be priced — and negotiated — accordingly.

See the website valuation guide for how growth rate affects multiples, and the negotiation guide for how to use trend data as leverage.

4. Ignoring traffic and revenue concentration risk

A site that earns 90% of its revenue from a single affiliate program, or derives 85% of its traffic from a single keyword, is far more fragile than its earnings history suggests. One algorithm update, one affiliate program closure, or one policy change can destroy the business overnight.

Assess revenue concentration by top revenue source: no single source should represent more than 40–50% of total revenue. Assess traffic source diversification by channel: ideally organic search, direct, referral, and email each contribute meaningfully. Heavy reliance on paid traffic is a platform risk — if the ad account is banned post-close, revenue collapses.

5. Underestimating key-person dependency

Many online businesses work because of who runs them, not just what they have built. A newsletter where 30% of open rates are driven by the founder's personal brand, a community where the founder is the most active member, or a YouTube channel linked to a personal account are all examples of key-person risk.

Ask the seller: “If you step away completely on day one, what happens to revenue?” Watch for hesitation. For content sites, check whether the top-performing content is bylined under the founder's name and whether the author has a large social following. For communities, check the ratio of founder posts to member posts.

A business with high key-person risk is not necessarily a bad acquisition — but it should command a lower multiple, and you should negotiate a longer transition period with documented handover of relationships and processes.

6. Not reading the backlink profile before buying a content site

Toxic backlinks — links from private blog networks (PBNs), link farms, or spam sites — can trigger a Google manual action or algorithmic penalty that wipes out organic traffic after you close. The seller may not disclose this risk because they may not know it exists, or because the penalty has not yet been applied.

Before making an offer on any content site, run the domain through Ahrefs or Semrush and review the backlink profile for: a sudden spike in referring domains, high proportions of links from foreign-language spam domains, links with exact-match anchor text at scale, and links from deindexed domains. Check Google Search Console for any existing manual actions under “Security & Manual Actions.”

See the SEO red flags guide for a complete checklist.

7. Skipping escrow on large transactions

Paying a seller directly — without an escrow intermediary — gives you no recourse if the seller disappears after receiving funds, fails to complete the transfer, or transfers assets that do not match what was agreed. This happens, even with sellers who appear legitimate throughout the deal process.

Use escrow for any transaction above $1,000. Escrow.com is the most widely used service for website acquisitions and supports international wires. The standard structure is: buyer deposits funds into escrow, assets are transferred, buyer verifies the transfer, escrow releases funds to seller. Do not deviate from this sequence — do not release funds before verifying assets.

8. Failing to verify what is actually included in the sale

Buyers sometimes close on a website and discover that the email list is in a personal account the seller is keeping, the social media accounts are not being transferred, or third-party tool subscriptions are in the seller's name and will be cancelled at month end. Asset inclusions need to be specified explicitly in the Asset Purchase Agreement.

Before signing the APA, create a complete asset inventory: domain and hosting accounts, email list and ESP account, all social media accounts, Google Analytics and Search Console properties, payment processor accounts, and all third-party software subscriptions. Each item should appear in the APA with a clear transfer obligation and timeline.

9. Not budgeting for working capital and post-acquisition costs

Many buyers deploy all available capital into the acquisition and have nothing left for operations. Revenue often dips 5–15% in the first 60–90 days post-acquisition as the business adjusts to new ownership. At the same time, you may need to upgrade hosting, replace tools, fix technical debt the seller had been ignoring, or hire content writers to maintain traffic.

A general rule: hold liquid reserves equal to at least 10–15% of the acquisition price to cover 6 months of operating costs and unexpected first-year expenses. See the working capital and cash flow guide for a breakdown by business type.

10. Buying without a clear post-acquisition plan

Acquiring a website is the beginning, not the end. Buyers who close without a clear plan for how they will maintain the site, grow it, and eventually exit it tend to let assets stagnate — which leads to revenue decay and a worse outcome when they eventually do sell.

Before you close, answer these questions: How will you maintain current traffic levels in the first 90 days? What is the single highest-impact growth lever for this business type? How many hours per week will you spend operating it, and is that sustainable? What exit multiple and timeline are you targeting?

See the 90-day post-acquisition action plan and the post-acquisition growth guide for a structured framework.