Buying a Web Hosting Business: Technical Due Diligence Checklist

What should your first data request cover?

Ask for exports and read access, not screenshots. A cropped dashboard image instead of a report export is itself a finding. Under a signed NDA, my list is short.

• A read-only WHMCS admin account, or a recent database backup, plus the version in use.
• Every report in the General, Income, Billing and Clients categories, exported for 24 months.
• A server list: hostname, provider, main IPv4, panel and version, and what runs on each.
• A license list: product, vendor, the name on the account, and the renewal date.
• The registrar, DNS, gateway and mail accounts, with the name on each one.
• The backup arrangement, and the date of the last restore that was actually tested.

Two lines matter most. The name on each vendor account decides whether you are buying a business or renting the seller's identity. The tested restore decides whether the data survives handover.

How do you verify the billing numbers inside WHMCS?

Rebuild the figures yourself from the reports at Reports > Reports, then check them against the gateway and the bank. The Reports page documents what each one counts, and several exclude what sellers quote as revenue.

Treat Income Forecast as the seller's best case, never as recurring revenue: its own definition assumes nothing cancels. Put Customer Retention Time beside it, because short average lifetimes under a confident forecast mean churn. Top 10 Clients by Income shows how much walks out with one phone call.

One number carries a cost. The WHMCS pricing page sells self-hosted plans by active clients, counts any client with at least one active product, service, addon or domain, and upgrades you automatically when you exceed the limit unless you opt out. Merging a client book into your install can move you up a tier.

How do you inventory the servers, panels and vendors?

Walk the server list against the panel, then against WHMCS, because the three rarely agree. The gap is where unbilled accounts live.

WHMCS gives you one quiet tool for this. The Disk Usage Summary report covers hosting accounts on active servers, and the documentation says it excludes disabled servers and any account with no matching record in WHMCS. It only fills in when Update Usage Statistics is enabled, so an empty report means a missing setting, not a clean estate. Compare its count with the account list in WHM. Accounts the billing system has never heard of are free hosting, staff sites or ex-clients nobody terminated, and none of them is in the price.

Record the provider and contract end date, the IPs, the panel and operating system with their support status, who holds root, and where backups go. Servers rented month to month are usually contracted in the seller's name and have to be re-signed by you. If you are buying a reseller operation rather than hardware, my WHMCS reseller hosting guide covers what to ask upstream.

Which licenses transfer with a hosting business, and which do not?

Assume none transfer until the vendor says otherwise in writing. This is the most expensive surprise in a small hosting deal, and WHMCS is the clearest example.

The WHMCS legal page states it plainly: WHMCS licenses, of any origin, may not be re-sold or transferred, and addons may be transferred between licenses within your own client account but not to other accounts. Section 2.2 says you may not rent, lease, sub-license, sell, assign, pledge or transfer the software without the prior written consent of WHMCS Limited, and section 9.8 extends that to assignment by operation of law. Move WHMCS to a New Server agrees from the practical side: moving the install to a new hosting provider requires a new license key.

Ask each vendor in writing before you agree a price. A no is not a deal breaker. It is a number you add to the price, and a reason to buy the client list and the data rather than the software estate.

What does the license stack cost once you own it?

Price it per server and per client, from the vendors' current pages, on the day you make the offer. The figures below are the ones I read on 2 November 2026 and they change.

Read the definition before you count: the cPanel pricing page says an account is a cPanel user account and that WHM reseller accounts count as one, so a server with 140 accounts is not a $69.99 server. The CloudLinux pricing page lists its unlimited-account tier at $18 per server per month for one server, $16 for two to four, $14 for five to 49 and $13 at 50 or more. WHMCS self-hosted starts at $34.95 a month for up to 250 active clients, $54.95 for 500 and $84.95 for 1,000. Add the lines up for the estate you plan to keep, not the one you are shown: a server you will consolidate within 90 days still costs a full license in month one.

How do you check the email and IP reputation you inherit?

Check the sending IPs and domains before you agree a price, because reputation is the one asset money cannot repair. Ask for Google Postmaster Tools access in the data request, not after signing.

Google publishes the thresholds. Its Email sender guidelines tell senders to keep the spam rate reported in Postmaster Tools below 0.3%, and to aim below 0.10%. Senders of more than 5,000 messages a day to Gmail accounts must meet the bulk sender requirements: SPF and DKIM for the sending domain plus a DMARC record, where the enforcement policy itself may be set to none. Every sender needs at least SPF or DKIM.

Then check the IPs against the blocklists. Spamhaus publishes the SBL for malicious network ranges, CSS for spam sources, XBL for compromised IPs, PBL for IPs that should not emit mail at all, DBL for low-reputation domains, and ZEN, which combines the SBL, XBL and PBL. Check every mail IP, every shared IP and the wider range the provider assigned, because listings often arrive at range level with neighbors you did not buy. If the mail IPs are listed, the options are to re-IP and rebuild authentication, or to walk away. My DMARC setup guide covers the records you rebuild either way.

What can stop the domain portfolio moving to you?

Mostly the 60-day locks in ICANN's Transfer Policy, plus the fact that the domains belong to the clients and not the seller. The Transfer Policy lets the registrar of record deny a transfer requested within 60 days of the domain's creation date, or within 60 days after a previous inter-registrar transfer. It also requires a denial where a 60-day lock was imposed after a Change of Registrant and the holder did not opt out before the change.

That shapes the deal twice. Recently registered or recently transferred names cannot move on your timetable, so a portfolio move runs over months. And changing the registrant to effect the sale can lock everything you just touched. Ask the registrar, not the seller, whether the account itself can be assigned to you.

While you are in WHMCS, pull the Domain Renewal Reminder Emails report. It logs sent renewal notices with dates and recipients, which the documentation describes as a way to export that information for ICANN compliance. An empty log on a portfolio of resold domains is an obligation you inherit.

How do you price the migration and its risks?

Cost it as a project with a date, before you agree the price, because the migration is where an acquisition usually loses money. Two moves are involved and they fail differently.

For hosting accounts, WHM's Transfer Tool documents the constraints: root or sudo on both sides, communication over port 2087, and no overlap with a system update. It does not carry two-factor authentication settings, so every client who used 2FA has to enroll again. If a database name already exists on the destination, the tool renames the source database during the transfer. DNS behavior depends on whether both servers sit in the same cluster. The same page points to a separate procedure for moving only a cPanel license's IP address between servers, which is what hardware consolidation needs.

For WHMCS the documented order is: disable the cron, back up and restore the database, fix custom paths in configuration.php such as $attachments_dir and $crons_dir, update DNS, reissue the license, update the System URL, re-create the cron, then check gateway callbacks, email forwarders and redirect URIs. My guide on how to migrate WHMCS walks the same sequence with downtime kept to minutes.

A short cut-over checklist, agreed in writing before completion:

• Credentials handed over in a shared vault, with the seller's access revoked on a named date.
• A full backup taken by you and restored by you, on your own infrastructure, before money moves.
• Gateways switched to your merchant account, with a test charge and a test refund.
• Mail moved to IPs you control, with SPF, DKIM and DMARC published before the first invoice run.
• The client notice sent from the seller's address, so it is not read as phishing.
• A transition period where the seller answers questions, with a date it ends.