Many telehealth and peptide sites carry a small round badge in the footer. It reads LegitScript Certified.
The badge is easy to misread. This page sets out what it certifies, what it leaves out, and how to check one.
Who issues the seal
LegitScript is a private company. Its own status page describes it as “a private certification body and not affiliated with any law enforcement agency” [5].
So the seal is not a government license. A state board or FDA did not issue it.
LegitScript runs several programs. The one telehealth and peptide sellers display is Healthcare Merchant Certification [2].
It is sold per website. LegitScript states that “each domain to be certified requires its own application fee and annual certification fee” [2].
A seal therefore speaks for one domain. A brand with three sites may have certified one of them.
The nine standards, one by one
LegitScript publishes its healthcare standards as a two-page document. It lists nine [1].
- Licensure and business registration. Licensed where medicine is prescribed or dispensed, and where the patient is [1].
- Legal compliance. The site must not facilitate drugs that lack the needed regulatory approval [1].
- Prior discipline and history. Disclosure of violations and litigation over the past ten years [1].
- Affiliates and partners. Partner pharmacies are generally required to be certified or accredited too [1].
- Patient services. The site must list the states or countries it serves [1].
- Privacy. Applicable privacy law, including HIPAA for US businesses handling health information [1].
- Validity of prescription. Prescription drugs only on a valid prescription, after care by a licensed professional [1].
- Transparency. Offers must not mislead about the pharmacy, staff, drugs, treatments or financial transactions [1].
- Advertising. Ads must be accurate and lawful [1].
One page on LegitScript’s site mentions ten core standards [2]. The same page links to nine, and the document lists nine.
Certification is also meant to continue. LegitScript describes “ongoing monitoring” of certified businesses [2].
A seal next to BPC-157
This is where the seal carries real information for a peptide buyer.
In September 2026, LegitScript named peptides that are “not currently eligible for compounding, sale, or use” in the US [7].
Its list: retatrutide, BPC-157, TB-500 and cagrilintide. It said certified customers may not engage with them outside that framework [7].
The ban is broad. Violations “also include offering the product, promoting it, or advertising it” [7].
Routing sales through a partner pharmacy does not help, LegitScript says. That still creates a certification concern [7].
So a live seal beside a BPC-157 order button is a contradiction. One of the two is not what it looks like.
The legal background is covered in are peptides legal. The human evidence is in BPC-157 human evidence.
Five questions the seal leaves open
Read the nine standards again for what is missing. The gaps matter more to a buyer than the list.
The product. No standard describes testing a medication’s identity, strength or purity [1]. The seal is not a lab result.
For that question, see how to read a peptide COA. A certificate of analysis is the document that speaks to the vial.
The price. The transparency standard bars misleading financial terms [1]. No standard says whether a price is fair or competitive.
The outcome. No standard measures whether a treatment works. The transparency standard does bar benefit claims no regulator has supported [1].
The whole business. The seal covers the certified domain [2]. A second site under the same brand needs its own check.
Today’s status. LegitScript says businesses lose certification, “sometimes quickly, when compliance concerns arise” [4].
Where Google and Meta come in
LegitScript’s own pitch names two reasons: advertising and payments [2]. The ad platforms name it in their written policies.
Google’s US rules allow online pharmacies accredited by LegitScript or by the National Association of Boards of Pharmacy, NABP [8].
For telemedicine, the same table names only LegitScript. Google allows telemedicine providers “if they’re accredited by LegitScript’s Healthcare Merchant Certification Program” [8].
That is not the last step. Google adds: “Advertisers must also be certified with Google” [8].
Meta’s rule is similar. It “requires online pharmacies and telehealth providers to be actively certified with LegitScript” [9].
Meta also limits those ads to adults, and to the US, Canada or New Zealand [9].
Card payments are the other reason. LegitScript calls its certification part of the approval process for card-not-present transactions with Visa and Mastercard [3].
That is LegitScript’s own description of what the card networks expect.
Checking a seal in six steps
LegitScript itself says the seal image is not enough. A seal on a page is “not, by itself, enough to confirm that a business is currently certified” [4].
It lists the tricks it sees. Sites show a seal they never earned, or keep one after losing certification [4].
Others use look-alike branding. One sign it names is “Legit Script” written as two words [4].
- Click the seal. LegitScript says a real one links to the business’s status page on legitscript.com [4].
- Read the address bar. The page must be on legitscript.com, not a look-alike domain.
- Check the domain named there. It should match the site you are about to buy from.
- If the seal does not click through, search the site at legitscript.com/websites [4].
- Expect friction. The lookup uses a reCAPTCHA, and it can refuse with a weekly limit message [6].
- If a seal looks false, report it. LegitScript takes reports through its status page [5].
A seller’s own “verify” link can land on that lookup. A refusal there is not proof of anything. Try the seal link, or try again later.
The pharmacy-only alternative: NABP
NABP is the association of state boards of pharmacy. It runs a separate program, Digital Pharmacy Accreditation [10].
It is for pharmacies only. Applicants must be licensed pharmacies with a pharmacist in charge [10].
A telehealth company that only prescribes is not a pharmacy. It cannot hold this accreditation.
The accreditation runs for three years [10]. It requires an active .pharmacy web address [10].
That address is the check. NABP says: “Unlike logos, the .pharmacy domain cannot be faked or forged” [11].
NABP also keeps a Not Recommended list of sites it found out of compliance [11]. Its search tool covers both lists.