What Is LegitScript Certification? Standards, Cost, and How to Verify Any Site

Quick answer

LegitScript certification is a paid, third-party review that an online pharmacy, telehealth provider or similar healthcare business passes to show it meets LegitScript's nine published Healthcare Certification Standards, followed by ongoing monitoring. As of September 2026, LegitScript reports more than 10,000 certified websites, Google's Healthcare and medicines policy names the program as the accreditation path for telemedicine advertisers in the United States, and you can check any domain in about one minute at legitscript.com/websites. It is a legality and transparency signal, not FDA approval, and it does not judge whether a treatment is right for you.

What is LegitScript certification for?

LegitScript describes its certification programs as "a recognized seal of approval that enables businesses to showcase their compliance, unlock opportunities to advertise, and accept digital payments." There are three programs: Healthcare, Addiction Treatment and CBD. The one that applies to telehealth and online pharmacies is Healthcare Merchant Certification.

For ad platforms and card networks, it is a compliance check on a high-risk category; for the business, a prerequisite for advertising and payments; for a patient, a public record. A certified site appears in LegitScript's lookup, carries a seal that links to a live status page, and stays under monitoring that combines "proprietary technology, regulatory intelligence, and expert human review." The name is sometimes misspelled "legiscript" or written as two words, "Legit Script"; LegitScript itself treats the two-word spelling as a warning sign.

What is LegitScript, and who relies on it?

LegitScript is a private company based in Portland, Oregon. Its About page says it was founded in 2007 in response to counterfeit pharmaceuticals sold online; its CEO is Scott Roth, per its September 16, 2026 press release. Per figures released September 16, 2026, it has certified more than 10,000 websites and classified more than 140,000 internet pharmacy websites as operating outside applicable regulations.

LegitScript's healthcare certification page states that "LegitScript Certification is trusted by Google, Meta, Microsoft, TikTok, LinkedIn, Netflix, Nextdoor, Yahoo, Visa, and Mastercard." Google's policy is quoted below. The Meta and Microsoft policy pages could not be opened for this article, so their requirements appear here only as LegitScript's claim. LegitScript's blog says certification exists first to help "payment processors, acquiring banks, and advertising platforms protect their ecosystems"; the consumer signal is a byproduct.

Why do online pharmacies and telehealth companies need it?

Because the largest ad platform requires it. Google's Healthcare and medicines policy, United States section, reads: "Google allows telemedicine providers if they're accredited by LegitScript's Healthcare Merchant Certification Program, which offers telemedicine certification to websites that provide virtual healthcare services and facilitate prescribing." For online pharmacies, the same section accepts LegitScript or NABP accreditation. Google's Prescription drug services policy adds that "Advertisers must be certified by Google in order to serve ads for prescription drug services."

On payments, LegitScript's guide states that Visa and Mastercard recognize the certification "to streamline the high risk merchant registration process for pharmacies and telemedicine providers that process card-not-present transactions."

Two caveats LegitScript publishes itself: certification is not a promise of advertising approval, and "LegitScript cannot predict, interpret, modify, or appeal advertising decisions made by advertising platforms." The platform still decides.

The nine Healthcare Certification Standards

LegitScript publishes its standards as a two-page PDF (2025 edition). In plain English:

1. Licensure and business registration. Licensed for the services offered, where medications are prescribed or dispensed and where the patient is located.
2. Legal compliance. Follows applicable law, and must not facilitate prescribing or dispensing of medications that lack "the necessary authorization or approval from the applicable regulatory body."
3. Prior discipline and history. Ten years of criminal, regulatory and civil history disclosed for the business and its clinicians.
4. Affiliates and partners. Partner pharmacies that fill prescriptions "are generally required to be LegitScript-certified or accredited by another recognized body." All domains must be disclosed.
5. Patient services. The website "must clearly disclose all states, territories, provinces, and/or countries" where services are available.
6. Privacy. Compliance with privacy law, including HIPAA for US businesses that handle protected health information.
7. Validity of prescription. Prescription drugs only on a valid prescription, and "a prescription or prescription drug must not be prescribed or dispensed prior to the provision of care by a licensed medical professional."
8. Transparency. No misleading practices, including "claims that a product or service has purported benefits that have not been supported by a regulatory body, such as the FTC, FDA, etc."
9. Advertising. Ads must be accurate and lawful; circumventing a platform's terms "may be grounds for certification denial or revocation."

What the standards mean for a telehealth patient

Four of the nine translate directly into things you can check on any telehealth site:

• Care before the prescription (standard 7). A certified provider cannot send a prescription before a licensed clinician has evaluated you; see what a first telehealth visit involves.
• States served (standard 5). The site must say where it operates. Telehealth licensing is state by state; see telehealth across state lines.
• The pharmacy behind the site (standard 4). The fulfillment pharmacy is expected to hold LegitScript certification or another recognized accreditation. Ask which pharmacy fills the prescription; this explainer on 503A versus 503B pharmacies covers the two types.
• No unsupported benefit claims (standards 8 and 9). The FTC says health claims must meet the "competent and reliable scientific evidence" standard. A certified site making promises its product label does not support is worth reporting.

What certification does not mean

Certification evaluates the business, not your treatment. It is a floor, not a ceiling.

• It is not FDA approval. LegitScript checks licenses, laws and disclosures; it does not test or approve medications. Compounded medications are not FDA-approved as final products, and a seal on a website that dispenses them does not change that; see is compounded semaglutide FDA-approved.
• It is not a clinical judgment. Whether a medication is appropriate for you is a decision for your licensed clinician.
• It is not law enforcement. LegitScript's status page states: "LegitScript is a private certification body and not affiliated with any law enforcement agency."
• It is not permanent. Enforcement "ranges from requiring remediation, to suspending certification, to pursuing legal action." A seal from last year proves nothing about today, which is why the live check matters.

How to check any website with the LegitScript lookup in one minute

1. Open legitscript.com/websites and enter the domain. In LegitScript's words, the result shows whether a site "is LegitScript-certified, legitimate, or rogue."
2. On the site itself, click the seal. Per LegitScript's September 17, 2026 post, a real seal "is dynamic, meaning it contains a live hyperlink directly to that business's certification status page on LegitScript's official website." A static image is a warning sign.
3. Check the spelling and artwork. Imitators rely on close approximations, for example "referring to 'Legit Script' as two separate words instead of one," or seals in the wrong colors or fonts.
4. Confirm the site names its clinicians or clinical partner, its dispensing pharmacy, and the states served. Verify a clinician with the state medical board (see verifying a doctor's license) and the pharmacy's license with the state board of pharmacy.
5. Read the pricing and cancellation terms before you sign up, and treat a site that hides either as a warning sign.

If something looks wrong, LegitScript takes reports through its website-certification-status page and says every report "is reviewed and, where warranted, acted upon."

What the five LegitScript classifications mean

LegitScript's classifications guide sorts websites into five buckets:

• Rogue. The merchant's "primary purpose is to engage in some sort of illegal, unsafe, or misleading activity, like selling prescription drugs or contact lenses without requiring a prescription."
• Unapproved. A compliance or risk problem "typically less egregious" than rogue.
• Unverified. A neutral label that usually denotes "the absence of an obvious problem" for a site not yet reviewed.
• Legitimate. Not LegitScript-certified but accredited by another body LegitScript recognizes, "such as the NABP."
• Certified. Vetted through LegitScript's review "and is monitored on an ongoing basis."

LegitScript vs NABP: the other recognized path

The National Association of Boards of Pharmacy (NABP) is the association of the state boards that license pharmacies. It runs Digital Pharmacy Accreditation, "a 3-year accreditation for pharmacies that have a website offering at least one interactive pharmacy practice component," and the .pharmacy domain under its Healthcare Merchant Accreditation program. Google's US policy accepts LegitScript, NABP Digital Pharmacy Accreditation, or a .pharmacy domain for online pharmacies; for telemedicine providers it names LegitScript only.

Patient-side, NABP's Safe Site Search at safe.pharmacy lets "you check whether a website is accredited by NABP or not recommended." A legitimate pharmacy may hold either credential; a telehealth company that advertises on Google needs LegitScript.

How does a business get certified, and what does it cost?

LegitScript's process has five published steps: check eligibility, gather documentation (licenses, clinical policies, ownership), submit the application through the client portal at certification.legitscript.com, expert review against the standards, and certification.

Fees, as published by LegitScript as of September 2026: a $975 nonrefundable application fee per website, and a $2,150 annual certification fee per website, due only on approval. Probationary certification, for businesses that meet the standards but "warrant heightened ongoing monitoring," carries a $3,995 annual fee as of September 2026. Optional expedited processing costs $2,500 per application as of September 2026. Fees apply per root domain; subdomains are covered.

How long does LegitScript certification take?

LegitScript does not say. Its FAQ states: "Every application is different, so we're unable to provide an estimated certification timeline." Expedited processing starts review "within two business days" after screening but "does not shorten the compliance review itself." One third-party figure exists: Corepay, a payment processor that helps merchants apply, writes that the process "typically takes 2 to 4 months" and depends on application completeness. Treat that as a processor's experience, not LegitScript's commitment.

Red flags that end the conversation

• No clinician evaluation before prescription medication
• No named pharmacy, or a pharmacy based outside the United States
• Promises that approval or results are certain
• Prices that look impossible for clinician-supervised care
• A certification seal that does not link to a live status page on legitscript.com

Is LegitScript itself legitimate? Limits and criticism

LegitScript is a private, fee-funded certifier, not a regulator; its authority comes from the platforms and card networks that rely on it. PharmacyChecker.com, a site that compares prices from international pharmacies, has an antitrust suit pending against LegitScript in the US District Court for the District of Oregon (PharmacyChecker.com LLC v. LegitScript LLC, No. 3:22-cv-00252, filed in New York in 2019 and transferred to Oregon in February 2022; the public docket shows filings as recent as May 2026). Those are allegations, not findings, and no court has ruled on the merits as of September 2026 per the docket. The honest reading: a meaningful, checkable compliance signal run by a company with commercial interests, best used alongside the license checks you can do yourself.

This article is for informational purposes only and does not constitute medical advice, diagnosis, or treatment. Always consult a qualified healthcare provider. Compounded medications are not FDA-approved as final products. Medication is prescribed only if a licensed physician determines it is appropriate.