How to Verify an Online GLP-1 Pharmacy: Six Public Checks

Every check worth running starts from one piece of information: the name of the pharmacy that will fill your order. With it you can search a state board license database, FDA's register of outsourcing facilities and FDA's warning letters in about ten minutes, all of them free and public. Without it there is nothing to check, and a seller that will not tell you has already answered the more important question.

Find the pharmacy's name first

Most GLP-1 you can buy online arrives through three separate parties wearing one brand. There is the brand on the website, the corporate entity that operates it, and the pharmacy that actually compounds and ships the vial. They are frequently three different names, and only the third one holds a license anyone can look up.

FDA's June 8, 2026 warning letter to Maximus Health, Inc. is a plain illustration. The letter is addressed to a company in Santa Monica, California, doing business as Maximus, operating a website at a fourth name again.^[5] Among the corrective steps FDA asked for was “identifying the entities that produce the compounded drug products offered on your website”. When the federal regulator has to ask a seller who makes the drug, a customer reading the homepage was never going to find out.

Look in the terms of service and the privacy policy before the marketing pages. Those documents are written by lawyers who need the entity named correctly, and they routinely disclose a pharmacy partner that the homepage does not. The shipping confirmation and the vial itself are the other two reliable places. We record the pharmacy for every seller we can trace in our pharmacy register, and we say so when we could not trace one.

Search the state board of pharmacy license database

This is the check FDA itself tells consumers to run, and the agency maintains a page linking every state board's license lookup so you do not have to find yours.^[2] Its instruction is unusually blunt for a federal safety page: if your online pharmacy is not listed, you should not use that pharmacy. FDA then asks you to confirm three more things about a pharmacy that is listed — that it requires a doctor's prescription, that it gives a physical US address and telephone number, and that a licensed pharmacist is available to answer questions.^[2]

Two states can matter, not one. FDA's warning signs list treats a pharmacy that is “not licensed in the United States and by your state board of pharmacy” as unsafe.^[1] A pharmacy in another state that ships to you is generally answerable to your board as well as its own, so search both. Boards also post disciplinary actions, and those are worth reading in full rather than by headline.

State boards carry more of this weight than people expect. FDA's own answer to who inspects compounders is that state boards have primary responsibility for the day-to-day oversight of state-licensed pharmacies not registered as outsourcing facilities; FDA conducts surveillance and for-cause inspections of those pharmacies but is not the routine inspector.^[3] For a 503A pharmacy, the state board is the register that counts.

If the seller claims 503B, read FDA's register

FDA publishes every facility registered under section 503B, updated weekly, and the table carries more than names. Each row gives the initial registration date, the most recent registration date, the date of the last FDA inspection, whether a Form FDA 483 was issued, whether a recall was conducted, and what action followed the inspection.^[4] When we pulled it on August 14, 2026 it held 98 facilities, and 40 of them carried the words “Not yet inspected”. We take that register apart properly in our analysis of the 503B register, where the headline number turns out to be the misleading one.

One more limit on that table, stated by FDA on the page itself: it does not include state board of pharmacy actions. To find out whether a registered facility has been the subject of a state enforcement action you have to go to the board in the state where the facility sits.^[4] A clean row is not a clean record.

Match on name and city, never on name alone

The step where verification quietly turns into invention is the lookup itself. Our own register holds 68 pharmacies and seven of them appear on FDA's 503B list, but one of those seven is “Empower Pharmacy” on our side and “Empower Pharma” on FDA's. That pairing is only trustworthy because both are in Houston, Texas. We require a name and a city and a state before we call it a match, and when two candidates sit in one city we record no match at all, because a coin flip is not a finding.

Run your own search the same way. A resemblance between two company names is a reason to keep looking, not a result.

Read accreditation for what it certifies

Two seals show up constantly on GLP-1 checkout pages. Both are real, both are voluntary, and neither is a government authorization.

NABP's Digital Pharmacy Accreditation runs for three years and is open to a licensed US pharmacy with a website offering at least one interactive pharmacy service. It requires current active state licenses, a pharmacist in responsible charge, a record of actually dispensing, and an active .pharmacy domain obtained through NABP's Healthcare Merchant Accreditation.^[6] What it verifies is that a licensed pharmacy is running a legitimate dispensing operation online. It says nothing about any specific product on the site, and a compounded GLP-1 is not approved merely because the pharmacy that made it is accredited.

PCAB accreditation, run by the Accreditation Commission for Health Care, is aimed at compounding specifically: it verifies compliance with USP General Chapters <795>, <797> and <800>, the standards governing nonsterile compounding, sterile compounding and hazardous drug handling.^[7] That is a meaningful thing to hold. It is also entirely optional, so its absence is not a violation, and 14 of the 68 pharmacies in our register carry it.

Treat any seal as a claim until you find it in the accrediting body's own directory. Both organizations publish searchable lists of who currently holds their accreditation, which is the only place the badge on a seller's footer can be confirmed. Some of the credentials in our own register are self-reported by the seller and we label them that way, because a badge repeated by us is still a badge.

Check the warning letters

FDA publishes warning letters in a searchable database, and the GLP-1 market appears in it heavily. We mirror the ones that name GLP-1 drugs in our warning letter register, which held 186 letters dated from October 2, 2023 to June 8, 2026 when this was written, the largest groups being unlawful internet sales of unapproved and misbranded drugs and false or misleading marketing claims.^[8]

Two cautions when you search it yourself. Match on the company and its address, not on a name that looks close, for the same reason the register lookup needs a city. And read what the letter actually alleges: a letter is a disclosure, not a disqualification. Several concern website wording rather than what came out of the clean room, and a company that answered a letter and fixed the claim is in a different position from one that did not.

Categories that do not exist

A specific class of marketing line is worth learning by sight, because it invokes an FDA category that has never existed. FDA made the point directly in the Maximus letter: representing a compounding pharmacy or outsourcing facility as FDA-approved or FDA-licensed is false and misleading, because those terms imply a formal authorization FDA does not grant to such entities or their compounded products.^[5]

• “FDA-approved compounded semaglutide” — compounded drugs are not FDA-approved, by definition, and the phrase describes nothing.^[3]
• “FDA-approved pharmacy” or “FDA-licensed pharmacy” — the FD&C Act establishes no such designation.^[5]
• “FDA-monitored” or “FDA-inspected facility” as a quality claim — an inspection date is a fact you can look up, and 40 of the 98 registered facilities had never had one.^[4]
• “Tested in FDA-approved labs” — FDA does not approve testing laboratories in the sense this sentence needs. Ask instead for the certificate of analysis and who issued it.
• “FDA-registered” used to mean approved — registration is an administrative filing, and FDA says explicitly that it is not approval or licensure of the facility or its products.^[5]

Red flags that end the check early

FDA's own warning signs for an online pharmacy are short: it does not require a doctor's prescription, it is not licensed in the US and by your state board, it has no licensed pharmacist to answer questions, the medicine arrives looking different or in damaged or foreign-language packaging with no expiration date, the discounts are too good to be true, or it charges you for things you never ordered.^[1] From tracing this market we would add four more.

• No pharmacy is named anywhere, including in the terms of service and on the vial. There is no license to look up and no one to complain to.
• Payment is taken before any clinician is involved. A questionnaire reviewed by a prescriber is lawful in most states and can be legitimate; a checkout that charges the card first has put the consult after the sale.
• A label reading “not for human consumption”, or “research use only”. That is the seller's legal position in writing, not a grade of product, and we take it apart in what “research use only” really means.
• No prescription required at all. FDA's guidance for buying medicine online reduces to using a state-licensed pharmacy and holding a real prescription; the rest of the argument is downstream of that.^[9]

The six checks, in order

1. Name the dispensing pharmacy. Check the terms of service, the privacy policy, the order confirmation and the vial. If no document names one, stop here.
2. Search your state board's license database, and the pharmacy's home state board. Not listed means do not use it.^[2]
3. If the seller claims 503B, find the facility on FDA's register by name and city and state, and read the last-inspection column rather than the fact of registration.^[4]
4. Confirm any accreditation seal in the accrediting body's own directory, and read what that accreditation covers.^[6][7]
5. Search FDA's warning letters for the operating entity and the pharmacy, matching on company and address.^[8]
6. Read the claims for categories that do not exist, then read the billing terms. A month is sometimes four weeks, and a headline is often a first-month rate; our price tracker carries a verified date next to every figure.