Most bad acquisitions don't fail because the buyer was careless. They fail because the seller knew exactly what they were selling, and the buyer didn't. A content site generating $8,000/month in profit sounds compelling until you find out that 94% of its traffic came from a single Google update cycle that peaked 18 months ago and has been declining ever since. That's not a deal. That's a liability with a nice-looking P&L attached.
This guide covers the red flags that matter. The ones that should make you pause, renegotiate, or walk away. Not every flag is fatal, but you need to know which ones are.
The Financials Don't Survive Basic Scrutiny
The first thing you do with any listing is rebuilt the P&L from source documents. Not the seller's summary PDF. Not the broker's adjusted EBITDA. The actual Stripe dashboard exports, bank statements, and ad account spend reports.
When sellers present SDE (Seller's Discretionary Earnings), they're allowed to add back legitimate one-time expenses and personal perks. What some of them also do is add back costs that aren't actually discretionary. Things like a part-time contractor who handles customer support, or a SaaS tool the business literally can't run without. Strip those out and the multiple goes from 3.5x to 5.2x. That's not a minor discrepancy. That's a different business.
Watch for:
- Revenue that doesn't match bank deposits within a 5–10% tolerance
- Profit margins significantly higher than industry comps (a content site claiming 85% margins with paid writers deserves a hard second look)
- Sudden revenue spikes in the 3–6 months before listing. Classic staging
- Add-backs exceeding 20–25% of stated SDE
If the seller can't provide 24 months of verifiable financials, that's not a due diligence gap. That's a reason to end the conversation.
Traffic Concentration Is a Valuation Problem, Not Just a Risk Flag
Here's a position worth stating plainly: single-channel traffic dependency should reduce your offer price, not just your confidence level.
If 80% of a content site's traffic comes from Google organic search, that's existential concentration risk. Google's core algorithm updates have wiped out entire business models in a single day. The March 2024 core update and the September 2023 Helpful Content update killed thousands of affiliate and programmatic content sites. Some lost 60–80% of their traffic overnight.
The right response isn't to accept the listing price and apply a vague "risk adjustment" in your head. Reprice. A site with diversified traffic. Email, direct, social, SEO. Might justify a 3.5x SDE multiple. A site where Google can delete your business on a Tuesday afternoon? You're looking at 2x or less, and you should say so in your offer letter.
The same logic applies to SaaS businesses dependent on a single acquisition channel. Say, a Chrome extension getting 90% of signups from the Chrome Web Store. Or ecommerce stores where 70%+ of revenue runs through Amazon's ecosystem.
What healthy traffic diversification actually looks like:
- No single channel above 50–60% of total traffic or revenue
- An email list with meaningful open rates (20%+ for a content business) as a stable, owned asset
- Some direct traffic, which usually signals real brand recognition rather than algorithmic luck
Customer Concentration: The Silent Deal-Killer
A SaaS business with $25,000 MRR looks great until you see that $9,000 of it comes from one enterprise client on a month-to-month contract. That's 36% of revenue one cancellation email away from disappearing. If that client churns in month three of your ownership, you overpaid. Significantly.
The threshold that should trigger hard questions: any single customer representing more than 15–20% of revenue. Above that, you're not buying a business. You're buying a client relationship you don't have yet.
For ecommerce and FBA businesses, concentration looks different. It's less about individual buyers and more about platform dependency. An FBA business doing $600K annually, entirely through Amazon, is exposed to account suspension risk, Buy Box algorithm changes, and Amazon's ability to launch a competing product in your category. These are documented, recurring events. Not hypotheticals.
Ask for customer-level revenue breakdowns. If the seller doesn't provide them. Even under NDA. That tells you something.
The Owner Is the Business
This is one of the most common and underappreciated red flags in small business acquisitions. It's especially bad in service businesses and personal brand content sites.
If the business runs because of the seller's relationships, reputation, or personal network, and there's no documented system for replacing any of that, you have a problem. The question worth asking yourself: what happens to revenue in month four, when the seller's no longer available for calls?
Questions that surface this risk:
- Does the business have SOPs for core workflows?
- What's the seller's role in client delivery versus business development?
- Has the seller ever taken two weeks off without revenue dipping?
- Are customer relationships in a CRM, or do they live in the seller's inbox?
A seller who can't answer these questions clearly. Or who keeps saying "it's pretty simple once you understand the clients". Is telling you the transition risk is high and the business is worth less than listed.
For content sites and newsletters, this shows up differently. Look at whether the writing voice is deeply personal and irreplaceable, or whether the content follows formats a competent writer could pick up in a week.
Legal and IP Red Flags That Buyers Miss
Most first-time buyers focus on financials and traffic. The legal layer gets skimmed. That's where expensive surprises tend to live.
Trademark status: Does the business own its brand name, or is it operating with a pending trademark or no registration at all? A business built on an unregistered brand can get challenged after you close. Run a USPTO search and check for pending disputes before you sign anything.
Content ownership: For content businesses, who created the content, and is there documented proof of ownership or work-for-hire agreements with contractors? This isn't theoretical. There are acquisitions that have blown up over exactly this.
Platform terms compliance: Does the business violate any terms of service it depends on? This comes up constantly in FBA (review manipulation, prohibited product categories), content sites using scraped or AI-generated content against publisher policies, and affiliate sites running afoul of network rules.
Pending disputes: Ask directly whether there are outstanding legal claims, supplier disputes, or DMCA complaints. Include a representation and warranty on this in your purchase agreement. If the seller lies, you have recourse.
The Broker's Pitch vs. Reality
This section will make some brokers uncomfortable. That's fine.
Broker-listed businesses come with polished marketing packages. Financials are presented in the best possible light, the narrative is buyer-optimized, and the asking price reflects seller expectations more than market reality. That's the broker's job. Your job is to look past the package.
Empire Flippers and FE International run thorough vetting processes and don't list businesses they can't verify. Their multiples reflect this. You'll pay for the due diligence they've already done. That still doesn't mean you skip yours.
Flip pa has a wider range. Genuine deals and genuine disasters sit on the same platform, sometimes at similar prices. The verification tools help, but they're not a substitute for source documents.
Acquire.com is founder-led and less intermediate. Less polish, more direct access to the seller, which is actually useful. Founders will tell you think brokers wouldn't include in a listing.
The red flag isn't which platform a business is listed on. It's when broker language substitutes for actual data. "Significant growth potential" means nothing. Three years of P&L trending at 15% YoY revenue growth means something.
When a Red Flag Is Actually a Buying Opportunity
Not every red flag is a reason to walk. Some are reasons to negotiate.
Owner dependency is a risk. But if the seller's willing to do a 12-month earn out with active transition support, you've transferred some of that risk back to them. Traffic concentration is a risk. But if you have a specific diversification plan and the current traffic is stable rather than declining, you can price that in and potentially create real value post-acquisition.
The distinction that matters: a red flag you can mitigate with structure or a price reduction is a negotiating tool. A red flag that represents deception or an unfixable dependency is a reason to leave.
Financials that don't reconcile aren't a negotiating tool. Walk.
A business where the seller is the brand and won't do a real transition? Reprice aggressively or walk.
A content site with 78% Google traffic that's been stable for three years, with a diversified backlink profile? Price in the risk and make a lower offer. That's a different situation entirely.
Before You Close
Due diligence on a small business acquisition is learnable. The questions aren't secret. The financials aren't magic. What separates buyers who overpay from buyers who don't is mostly preparation. Knowing what to ask for, knowing what to build, and understanding what the numbers actually mean.
DealScorer's free tools and acquisition checklist are built for exactly this stage: financial verification, spotting concentration risks, structuring your offer before you're sitting across from a seller who's done this before and you haven't. If you're actively evaluating a listing, run through the checklist before you make an offer.
The deal you don't do is often the best one you make.