Is This Online Pharmacy Legit? A 5-Step GLP-1 Check

To check whether an online pharmacy is legitimate, look it up in your own state's board of pharmacy license database, then run its web address through the National Association of Boards of Pharmacy (NABP) search at safe.pharmacy. If the pharmacy is not licensed in your state, does not require a prescription, or hides its US address and pharmacist, the FDA's advice is simple: do not use it.

That is the whole answer. The rest of this guide shows you exactly where to click, what the results mean, and why "the site looked really professional" is not on the list.

Why does a good-looking website prove nothing?

A pharmacy website is just a website. Logos, a white-coat stock photo, a padlock icon, glowing reviews and a "US-based support team" banner all cost almost nothing to fake. NABP, which coordinates state pharmacy boards, says it has found more than 40,000 illegal pharmacy websites over the years.

GLP-1 medicines are a magnet for this. They are expensive, in demand, and often bought by people who have already been told "not covered" by their plan. That combination is exactly what a rogue seller looks for.

Step 1: Check the license in your state

This is the most important step and it takes about three minutes.

1. Go to the FDA's BeSafeRx "Locate a State-Licensed Online Pharmacy" page (fda.gov, search "BeSafeRx locate"). It links to every state's license lookup, from Alabama to Wyoming, plus DC, Guam, Puerto Rico and the Virgin Islands.
2. Click your state, the one the medicine will be shipped to, not the state the pharmacy says it is in.
3. Search by the pharmacy's business name (the legal name is usually in the site footer or terms of service).

The FDA's instruction is blunt: if the online pharmacy is not listed in your state's database, you should not use that pharmacy.

What if the name on the website doesn't match anything? Many telehealth brands are not pharmacies at all. They send your prescription to a partner pharmacy. Ask the company for that pharmacy's legal name and license number, then search that. A legitimate business will tell you; a vague "our trusted partner network" is a reason to pause.

Step 2: Run the web address through Safe.Pharmacy

NABP runs a consumer site at safe.pharmacy with a Safe Site Search tool. Paste the exact web address you are about to buy from. You are looking for one of three outcomes:

Result	What it means
Accredited / verified	The site has gone through NABP review, for example its Digital Pharmacy Accreditation
Not Recommended	NABP reviewed the site and found it out of line with pharmacy laws or its standards
Not found	NABP has no record either way, so lean on Step 1

"Not found" is not a pass. The tool can't review every website on the internet, so treat the state license check as the deciding test.

Step 3: Look at the web address itself

NABP became the registry operator for the .pharmacy top-level domain in 2014, and sites have to be vetted before they can use it. So a pharmacy at something.pharmacy has cleared an extra screen. The reverse is not true: plenty of legitimate pharmacies use a plain .com address. Treat .pharmacy as a nice bonus, not a requirement, and watch out for look-alike spellings of real pharmacy names.

Step 4: Run the FDA's four-sign test

FDA's BeSafeRx campaign says an online pharmacy is likely safe if it:

• always requires a valid prescription from your doctor or other prescriber,
• lists a physical US address and a US phone number,
• has a licensed pharmacist available to answer your questions, and
• is licensed by your state board of pharmacy (Step 1 again, because it matters that much).

And the FDA lists these as signs of a possibly unsafe site:

• No prescription needed, or a "free doctor consult" that is just a checkbox
• Not licensed in the US or in your state
• No pharmacist to talk to
• Prices that seem too good to be true
• Medicine that arrives looking different from what a local pharmacy dispenses, damaged, labeled in a foreign language, expired or with no expiration date
• Charges for things you never ordered
• No clear explanation of how it protects your personal and financial information

Step 5: Read the product page like an inspector

Even a licensed pharmacy should be clear about what it is selling. For GLP-1s, check:

• Brand-name or compounded? Compounded semaglutide or tirzepatide is not FDA-approved. If a page calls it "generic Wegovy," that is a claim the FDA has told telehealth companies to stop making. (See our breakdown of the FDA warning letters.)
• "Research use only" anywhere on the page? That's not a pharmacy product. Here is what that label really means.
• Payment by crypto, gift card or a money-transfer app only? Legitimate pharmacies take normal payment methods.
• Ordering through a direct message on social media? Pharmacies don't sell injectable prescription drugs through DMs.

For a deeper list of compounded-product warning signs, see our compounded GLP-1 red flags guide.

A two-minute scenario

Say you see an ad: "Tirzepatide, $99/month, no insurance needed, ships today." You click.

• Footer lists a company name. You search your state's board: nothing.
• Safe Site Search: Not Recommended.
• Checkout asks for a "quick health quiz" with no prescriber name.
• Payment: crypto gets a 15% discount.

That's four strikes before you even look at the product. Close the tab. Compare that with a pharmacy that shows up in your state's lookup, gives you a pharmacist's phone line, and refuses to ship until it has a prescription. Boring, and exactly right.

What if I already ordered from a sketchy site?

Don't panic, and don't use the product while you sort it out.

• Keep everything: the box, vial or pen, labels, order confirmation and the web address.
• Talk to a pharmacist or your prescriber about whether to use it and what to do for your treatment in the meantime.
• Report the website to the FDA through its online form for illegal online medicine sales (linked from the BeSafeRx page), or call 1-888-INFO-FDA (1-888-463-6332).
• Report side effects through FDA MedWatch. If symptoms are severe, call 911. For a possible overdose, call Poison Control at 1-800-222-1222.
• Call your card issuer if you were charged for something you didn't receive.

If the package itself looks off, our counterfeit GLP-1 guide covers the packaging and lot-number checks.

Once you have a verified pharmacy, keeping track of which pharmacy filled each pen, and when, is surprisingly useful. A dated shot log plus a quick journal line ("new pharmacy, box looked different") in an app like GLPily, or on paper, helps when a refill doesn't match the last one.

Common questions

Is a pharmacy licensed in another state allowed to ship to me?

Only if it meets your state's rules. That's why the FDA tells you to search your own state's board database. If the pharmacy isn't listed there, the FDA says not to use it.

Does a .pharmacy web address guarantee a site is safe?

It means the site was vetted by NABP before it could use the domain, which is a strong signal. But many legitimate pharmacies use .com, so the state license lookup is still the main test.

Are telehealth companies and online pharmacies the same thing?

Often not. Many telehealth companies employ or contract the prescribers and then send prescriptions to a separate pharmacy. Ask for the pharmacy's legal name and license so you can check it too.

Is buying GLP-1s from a pharmacy outside the US okay if it's cheaper?

The FDA's guidance is to use pharmacies licensed in the US and by your state board. Drugs from unverified foreign sellers may be counterfeit, improperly stored or not the approved product.