Diligence on a $50k business should not look like diligence on a $50M one. But it should not look like nothing either. This is the list, ordered by what each item costs you if you skip it and it turns out to matter.
Tier 1 — deal-killers. Do these before anything else.
Revenue, verified at source. Read-only access to the payment processor, or a provider-verified figure. Not a screenshot, not a CSV.
Traffic, verified at source. Analytics access with the property and date range visible.
Ownership of the domain. Check the registrar account, the registration date and that the seller is the registrant.
Ownership of the code. Who wrote it, under what agreement, and is any of it under a licence that forbids resale?
Chargeback and refund rate. A 6% refund rate quietly deletes 6% of the revenue you're pricing.
Any live legal or platform dispute. A pending trademark complaint or an app-store review flag transfers with the asset.
Tier 2 — price-changers. These move the number.
Month-by-month revenue for 24 months, if it exists.
Churn by month, and whether it's drifting.
Revenue by customer — check the top ten as a share of the total.
Traffic by source, and how much comes from one keyword or one referrer.
Every recurring cost, with the invoice.
Ad spend and its actual return, if any.
Failed-payment recovery rate — often several points of hidden churn.
Pricing history and what happened to churn each time it changed.
The support volume: tickets per month, and how long they take.
Whether any revenue is one-off (lifetime deals, consulting) rather than recurring.
Tier 3 — transfer risk. Cheap to check, expensive to discover late.
Can the payment processor account transfer, or must customers re-enter cards? This one has killed more deals than any other.
Are third-party API keys on the seller's personal accounts?
Is the hosting on a plan that transfers, or a personal free tier?
Does the email sending domain have its own reputation, or does it ride on the seller's?
Are the social accounts, if any, tied to a personal profile?
Is there a mailing list, and did subscribers consent in a way that survives a change of owner?
What is the actual, tested restore procedure for the database?
Tier 4 — the code and the ops
Clone the repo and get it running locally. If you can't, that's the finding.
Check the commit history for a long tail of quiet abandonment.
Look for hard-coded credentials — you'll need to rotate all of them anyway.
Count the dependencies that are unmaintained or several majors behind.
Find out what happens when it goes down at 2am, and who currently notices.
Read the last 50 support tickets. It's the fastest possible product education.
How long this should take
For a deal under $100k, a focused week is proportionate — a day on Tier 1, two days on Tier 2, and the rest on the code and a proper read of the support inbox. Anything longer and you're either buying something too complicated for the price, or you're procrastinating.