The Ultimate Technical Due Diligence Checklist for Website Buyers

The listing showed $8k MRR and a clean UI. After close, the buyer discovered unmaintained dependencies, a banned API key, and a Google manual action buried in Search Console— $40k in rebuild and traffic loss that diligence would have caught in an afternoon. Technical due diligence is how you buy a digital asset, not a liability dressed as revenue.

This checklist serves both non-technical buyers (who should hire a fractional CTO or senior dev for 4–8 hours) and technical operators running their own audits. We cover repository health, third-party dependencies, API reliance, database scalability, and SEO backlink profiles—everything you need before wiring escrow on a digital asset acquisition.

1. Pre-Audit Setup: Access You Must Demand Before LOI

Never sign an LOI without a defined data room. Minimum access for any software or website acquisition:

• Git repository — read access to production branch history (GitHub, GitLab, Bitbucket)
• Hosting & infra — Vercel, AWS, Railway, or DigitalOcean with billing visibility
• Database — read-only connection string or sanitized dump
• Third-party dashboards — Stripe, SendGrid, OpenAI, analytics, error tracking (Sentry)
• Domain & DNS — registrar access or transfer unlock confirmation
• Search Console + Ahrefs/Semrush — for content and SEO-dependent assets

If the seller refuses repo access until after close, walk. No exceptions for “IP concerns”—use an NDA and time-boxed access instead.

2. Repository Health: The Code Audit SaaS Buyers Cannot Skip

A code audit SaaS workflow starts locally: clone, install, run. If you cannot boot the app in under 60 minutes with documented steps, budget professional remediation.

Repository checklist

Tech stack inspection priorities

Run tech stack inspection with automated scanners plus human review:

• npm audit / pip audit / bundler-audit — critical CVEs in production dependencies
• Framework EOL check — Rails 5, Node 16, PHP 7.x are rebuild triggers
• Monolith vs. microservices — micro-SaaS should be a monolith; unnecessary complexity adds ops cost
• AI/LLM integration — prompt injection surfaces, token cost per user, vendor lock-in

3. Third-Party Dependencies and API Reliance

Modern micro-SaaS is a patchwork of APIs. Map every external dependency and score single-point-of-failure risk.

Dependency risk matrix

Red flag: core product feature depends on an undocumented scraper or a founder's personal API key. Discount heavily or require seller warranty in the APA.

4. Database Scalability and Data Integrity

A $5k MRR app on an overloaded Postgres instance will not survive your growth plan. Audit data layer before you inherit it.

• Schema review: missing indexes on high-traffic queries; N+1 patterns in ORM logs
• Row counts & growth rate: project 12-month storage and query cost at 3× users
• Backup & restore: demand proof of last successful restore—not just backup cron logs
• PII & GDPR: data retention policies, export/delete endpoints, subprocessors list
• Multi-tenancy isolation: for B2B SaaS, verify tenant data cannot leak across accounts

Run EXPLAIN ANALYZE on the five slowest reported queries from logs. If every query scans full tables, budget 2–4 weeks of performance work post-close.

5. SEO Backlink Profile and Hidden Penalty Detection

Content and SEO-driven acquisitions live or die by organic traffic integrity. A pretty Ahrefs chart can hide a manual action or toxic link blast from 2019.

SEO due diligence workflow

1. Google Search Console: check Manual Actions, Security Issues, and Coverage errors
2. Traffic cliff analysis: align GA traffic drops with core update dates (Helpful Content, Spam)
3. Backlink audit: Ahrefs or Semrush—flag PBN patterns, casino/pharma anchors, sudden link velocity
4. Content quality sample: read 10 top landing pages—thin AI slop triggers future penalties
5. Cannibalization: multiple URLs targeting identical keywords without clear hierarchy

Deal-killer: active manual action or confirmed algorithmic penalty with no recovery plan. Do not assume you can “SEO your way out” in 30 days.

6. Security, Compliance, and Operational Readiness

• OWASP top 10 spot check: SQL injection, XSS, broken auth on staging clone
• Uptime history: 90-day Statuspage or Better Uptime logs—chronic outages erode NRR
• On-call burden: how many pages/month does the seller get at 2am?
• SOC 2 / HIPAA: if claimed, request report; if required by customers, budget audit cost

7. The 90-Minute Technical DD Sprint (Printable)

Short on time? Run this sprint on any micro-SaaS listing:

Pair technical findings with financial diligence from our micro-SaaS valuation guide and smart shopping framework. Technical pass + bad economics still equals pass.