Unfortunately there's a lot of misinformation being spread where it comes to the subject of due diligence. This is partially due to ignorance (many people fail to realise that performing due diligence on a £5k/year blog is a bit different from performing due diligence on a £500k/year online business), but also because of, well, the Internet
It's also an incredibly complex topic, which can't be taught in one forum post (or 50, for that matter), but let me address some of the questions/comments posted above and try to at least give a few tips.
FWIW, I've been in the industry of online business brokerage for the last 5 years and during this time have established a (now world leading) brokerage, as well as a company that specialises in online business due diligence so my knowledge on the matter is a bit more than theoretical.
What industry standard applications would you think are acceptable for proving web based stats for valuating and selling a website business?
Newsletter
During duedil would you let them have access to say mailchimp for your newsletter stats? Could they have read access only.
Traffic
Google analytics? They would probably go for server logs on this.
Generally speaking, as a buyer you will want to verify all claims. This includes both claims about the size of the mailing list (for which you'll need to see the Mailchimp account associated with the site) and traffic claims (for which you'll need Google Analytics), but most importantly any revenue claims.
This usually happens within the due diligence process though, e.g. once an offer has been made and accepted, rather than before whilst you're still simply evaluating the business. This is because needless to say you'll gain access to fairly sensitive data, and it's never in the best interest of either the seller or the eventual buyer of the business to grant access to this data to tens of people who are purely evaluating the opportunity.
Note though that server logs (or stats derived from server logs, e.g. AWStats, Webalizer, etc.) are rarely usable for verification purposes due to the ease at which these can be forged.
I would install my on own analyitics for a month and see what happens.
Considering how popular Google Analytics is and taking into account the way it operates (you can grant a third person guest access to your account), this is quite sufficient. Further, installing your own analytics for a month is very rarely an option, as a month is a very long time when it comes to online acquisitions (where demand by far outweighs supply).
I've seen sites for sale on Flippa and others. For the sales info they generally screengrab the last 3 months of Google Analytics data or Adsense income etc. If you get someone serious who wants to see live data you can share the data with their Google Account as read only.
There are a few critical misconceptions here:
1) For a business that wasn't established yesterday, a mere 3 months of data won't show you anything. Always request at least 12 months of data to get even some sort of a picture, and 3+ years to get a proper overview. With less than 2 years you will have no idea whether there's any seasonality involved or even how old the business truly is (which is extremely relevant as it helps you evaluate the sustainability of its traffic sources).
2) Forget about screengrabs and ALWAYS either request live access or do your verification over a live screen sharing session. Screenshots are so easy to forge nowadays that anybody with half a brain can edit their PayPal account to make it look like it has £995 million in it (as opposed to the actual 91 pence), and the best of it - in most cases it's impossible to tell the difference between a genuine screenshot and a manipulated one.
If I had to pick one recommendation when it comes to due diligence and traffic/revenue verification then it would be this last point - NEVER rely on screenshots.
