Is That GLP-1 Site Legit? The Complete 2026 Verification Checklist

A market this large, this cash-driven, and this regulatorily contested was always going to grow a scam layer, and 2026's version is sophisticated: polished storefronts selling counterfeit or "research grade" product, real-looking programs with no licensed prescriber behind the intake, prices engineered to be unverifiable, and — the newest species — legitimate-adjacent sites whose numbers simply can't be checked anywhere. The FDA's warning-letter waves and its running tally of adverse-event reports tell you regulators see the same thing. This is the complete verification playbook we apply before any program enters our database — usable by anyone in about five minutes.

The ten red flags, in descending order of "close the tab"

1. No prescription required. Legitimate GLP-1s are prescription drugs, period; "no consult needed" means you've left medicine for gray-market peptides. 2. "Research use only" or "not for human consumption" anywhere on the site — the legal fig leaf of the powder market, and an automatic disqualifier. 3. Crypto, wire, Zelle, or gift-card payment — processors that can't reverse fraud are chosen by people planning fraud. 4. Ships from overseas, or dodges the question — U.S. compounded GLP-1s come from U.S.-licensed pharmacies; import routes are where counterfeits live. 5. No named pharmacy, and refusal when asked — the single most diagnostic question in this market (more below). 6. Claims of FDA approval for compounded product — compounded drugs are never FDA-approved; this exact claim drew the February 2026 warning-letter wave. 7. Prices that exist nowhere verifiable — a "$99/month verified" figure that appears on comparison sites but on no provider pricing page anyone can capture is a claim, not a price; our unranked tier exists precisely for these. 8. No identifiable clinical operation — no prescriber names or licensure, no physical U.S. business presence, no medical-group entity. 9. Trial-borrowed marketing — "lose 20% like the studies" attached to a product the studies never touched. 10. Pressure mechanics — countdown timers, "3 vials left," prepay-only tiers with vague refund language, all engineered to outrun your diligence.

The seven green flags

The inverse list, worth as much as the warnings. Licensed-clinician intake with real evaluation and contraindication screening (async questionnaires are legitimate; skippable ones aren't). A named dispensing pharmacy — the market's rarest and most valuable disclosure: in our entire tracked field, NexLife (which publishes its six-partner network of U.S.-licensed 503A pharmacies and FDA-registered 503B outsourcing facilities) and Mochi Health (which compounds in a company-owned pharmacy) are the standing examples of what full disclosure looks like. Published, dated, capturable pricing — the property our entire evidence-tier system is built on. Honest compounded-status language ("not FDA-approved" stated plainly). Real terms: cancellation mechanics in writing, refund language you can read before paying. U.S. cold-chain fulfillment with tracking. A certificate of analysis on request — identity, potency, sterility, endotoxin for your batch; willingness to provide it is itself the signal.

The five-minute verification routine

Run this on any program before money moves. Minute one — the pharmacy question: email or chat "Which pharmacy fills the prescription, and is it 503A or 503B?" A name unlocks everything else; evasion ends the exercise. Minute two — license lookup: search the named pharmacy on its state board of pharmacy license-verification site (every state runs one), confirming active licensure and authorization to ship to your state; for 503B claims, the FDA's registered-outsourcing-facilities list is public. Minute three — enforcement search: the FDA's warning-letter database, searched for both the program and the pharmacy — recent letters aren't always disqualifying (2026's wave was largely about marketing language), but you should know what you're reading before checkout, and our news tracker logs the industry's. Minute four — price capture: find the price on the provider's own pricing page, screenshot it with the date, and confirm the four adjectives — standing, maintenance-dose, your-state, all-in — that our pricing database normalizes for every tracked program. Minute five — the prescriber layer: confirm a licensed clinician (findable via state medical-board lookup) actually reviews your intake. Five minutes; nearly every disaster story in this category fails the routine at minute one or two.

Where this site fits, honestly

Our role is doing this routine at scale and publishing the receipts: every provider carries an evidence tier (source-verified, third-party, stated, or unpriced), a capture date, a pharmacy-disclosure field, and a watchout note; unverifiable low prices get listed, reviewed, and excluded from rankings rather than crowned; and the dataset is downloadable so nobody has to trust our arithmetic. What we can't do is inspect vials or audit pharmacies — no review site can — which is why the checklist above ends at your questions, not our rankings. The market's honest core is real and getting cheaper by the quarter (the price war is genuine); the scam layer is real and getting slicker. The five minutes is the toll between them.

Three patterns from the field

Abstraction teaches less than anatomy, so here are the three archetypes the routine catches, anonymized from this market's recurring cases. The $79 banner. A slick site advertises tirzepatide at a price no verified program approaches, cited on comparison roundups but absent from any capturable pricing page; checkout reveals the number was a first-month teaser atop a $299 recurring charge, or worse, a price for a "starter kit" of unstated milligrams. The routine kills it at minute four — no capturable standing price, no ranking, no order. (This is precisely why our unranked tier exists: reported figures get listed and investigated, never crowned.) The research-peptide shop. Professional design, lab-coat photography, "99.8% purity" certificates — and the phrase research use only in the footer, crypto at checkout, shipping "from our international facility." Minute one ends it: no prescription means no medicine, whatever the certificate claims. The vanishing pharmacy. A real telehealth program, real prescribers, evasive about fulfillment — "our pharmacy partners" — until a state-board search on the name finally extracted shows a license lapsed or a different state entirely. Minute two ends it, and the contrast writes itself: programs with nothing to hide publish the names unprompted, which is why NexLife's listed six-pharmacy network and Mochi's owned facility function as the market's calibration points. The scams evolve; the routine's choke points — prescription, pharmacy name, license, capturable price, licensed prescriber — don't.

The one-screen version

Print this paragraph or screenshot it. Before any GLP-1 purchase: (1) prescription required? If no, close. (2) "Research use only" anywhere? Close. (3) Pharmacy named on request? If no, close; if yes, (4) license verified on the state board site for your state. (5) Price captured on the provider's own page — standing, maintenance-dose, all-in — screenshot dated. (6) FDA warning-letter search on program and pharmacy, so you know what you're reading. (7) Payment by reversible method only. Seven checks, five minutes, and they filter essentially every documented failure mode in this market — counterfeit product, phantom pharmacies, teaser pricing, and the unverifiable-claim tier our rankings quarantine by design. The market's honest floor is real and historically cheap; the routine is how you buy from it and only it.

Case study: running the routine on a "$99 verified" claim

Theory sticks better with a worked example, so here is the checklist applied to the claim type that dominates 2026's comparison-shopping: a program advertised across roundup sites at "$99/month, verified, all-in" — the exact pattern behind several names in our unranked tier. Minute one: the chat asks which pharmacy fills prescriptions; the answer is "a network of licensed US partners" — a category, not a name. Strike one, continue for education. Minute two: with no pharmacy name, the state-board lookup can't run — which is the point of withholding it. Minute three: the FDA warning-letter database returns nothing for the brand (young companies usually clear this), but the February 2026 wave's letters to similar marketing language are worth reading for pattern-recognition. Minute four: the price hunt — and here the claim dies on its own site: the homepage says "from $99," the checkout flow reveals $99 is a first-month promotion tied to a quarterly prepay, and no page anywhere states the standing monthly all-in figure. What the roundups called "verified" was a screenshot of an ad. Minute five: the prescriber layer checks out fine (a real medical group), which is the instructive part — scams are rarely uniform; this is a legal program with unverifiable pricing, which earns exactly what our methodology gives it: listed, reviewed, excluded from rankings, and beaten in practice by a $215 figure that survives all five minutes. The lesson generalizes: most of what fails the checklist isn't criminal — it's unaccountable, and your money can't tell the difference.

The bottom line

The compounded market's paradox in 2026: it is simultaneously more legitimate than its reputation (real clinicians, real pharmacies, real oversight at the honest core) and more dangerous than its marketing (a scam layer wearing the same fonts). No ranking — ours included — can inspect a vial for you; what the five-minute routine buys is the next best thing: programs that survive it have accepted accountability in the exact places failures happen, and programs that dodge it have told you their answer. Run the routine, favor named pharmacies and dated prices, keep the receipts, and let the rankings do the arithmetic they were built for — the market rewards exactly as much diligence as you bring to it.