What LegitScript Actually Reviews on Your Website

Most treatment centers meet LegitScript for the first time as a rejected ad. Somebody in marketing sets up a Google campaign, the ads are disapproved, and the fix turns out to be an application with sixteen standards, a nonrefundable fee and a reviewer who will open the website and read it. The certification is about the business. The website is where a lot of the business gets checked.

This piece is for the person who has to get that website ready. We read LegitScript's published standards and its certification FAQ on 13 September 2026, pulled out every requirement that a reviewer can verify by looking at your pages, and then fetched 44 treatment center pages that rank in twelve US cities to see how those requirements look in the wild. We build websites for addiction treatment programs, so we have a stake in this. We are not LegitScript and we are not lawyers, and LegitScript reserves the final call to itself in plain words.

In 30 seconds

LegitScript certifies the organization, not the site, but five of its sixteen standards are read straight off your pages. Standard 9 requires the physical address of every facility where services happen, a clear statement of what services you provide, and photos that truthfully show your own facilities. Standard 10 requires a posted privacy policy where the law calls for one. Standards 13 and 16 require that ads and offers are accurate, name your own business and never claim locations you do not serve. Standard 14 rules out most incentives, travel payment included. The application also asks for every domain you own. At standard pricing, one facility pays $4,690 in the first year.

What LegitScript is actually certifying

A business that treats substance use disorder, run by licensed people, in a clinical setting or over telehealth, in the United States or Canada, with a website that promotes its own treatment rather than referring people elsewhere. That is the self-check in LegitScript's own FAQ, and it is why the website is only part of the review. Its certification page groups the sixteen standards into four buckets: registration and compliance, internal practices, external practices, and transparency and advertising.

Most of the review happens off the page. Standard 1 wants the corporate registration and the licenses for every service and jurisdiction. Standard 4 wants a lease or ownership document for each location. Standard 6 wants proof that clinical staff are trained in addiction treatment. Standard 7 wants every criminal, regulatory or civil violation, plus any litigation from the past ten years. It says applicants must not have recent or repeated disciplinary sanctions, and that prior offenses may disqualify an applicant at LegitScript's sole discretion. No redesign changes any of that.

What a redesign does change is whether your public pages agree with the documents you upload. A reviewer holding your license and your lease can compare them with your contact page in under a minute. When they disagree, you are the one explaining.

Eligibility is narrower than many owners assume. The FAQ lists sober living homes, peer recovery coaching, sober transportation, DUI education classes, assessment-only services and lead generation sites as generally not eligible. Telehealth programs are eligible, and a brick-and-mortar building is not required.

What 44 treatment center pages showed us

Most of them already carry the basics, and the gaps sit in the claims, not the contact details. To check that against real pages rather than advice columns, we searched for drug or alcohol rehab in Nashville, Denver, Houston, Phoenix, Atlanta, Los Angeles, Boston, Chicago, Philadelphia, Delray Beach, Austin and San Diego on 13 September 2026. We set aside directories and aggregators and two programs that are our own clients, which left 56 provider pages. Eleven refused an automated request and one did not respond, so 44 were read.

For each page we checked the ranked page itself, the one a searcher lands on, not the whole site. Every hit for an address, an insurance phrase, a percentage or a travel offer was then read by hand before it was counted, because pattern matching on a web page produces junk: one early match for a success rate turned out to be a menu link to a research page.

Three findings matter for the rest of this article. First, 38 of the 44 pages put a street address in the page text, and three more had one only inside their structured data, which a person reading the page never sees. Second, 30 carried a LegitScript seal, a badge, a verification link or a written certification claim somewhere in their code. That does not mean the other 14 are uncertified: two of them are hospital departments, and LegitScript's public lookup sits behind a captcha, so we did not test status. Third, 14 pages told families they work with most or all major insurance. Three said all.

The census is a snapshot of pages that rank, not a sample of every program in the country. It is still a fair picture of the competition a new site is measured against.

Standard 9, read as a page brief

Standard 9 is the one written about websites, and it has four parts you can turn into a checklist. The site must conspicuously show the physical address of each facility where services are delivered. It must show the specific nature of the services. Every photo must truthfully and accurately depict your facilities. And nothing on it may misrepresent the scope or the location of what you offer.

The address. The word that matters is conspicuously. A footer address on one page of a twenty-page site is easy to miss, and a location listed only in schema markup is invisible to a human reviewer. For a multi-site operator the requirement multiplies: each facility where services happen needs its own address, which in practice means a location page per facility with the street address near the top.

The services. Name the levels of care you actually run, in the words your license uses: detox, residential, partial hospitalization, intensive outpatient. Standard 3 separately asks you to disclose every treatment service you offer or recommend, including whether medication is part of care and whether you run programs for specific groups such as adolescents. If the application says you do not treat adolescents and a service page says you do, the reviewer has found the problem for you.

The photos. This is the part stock libraries break. A photo of an ocean-view pool is not a truthful depiction of an outpatient suite in an office park. Standard 9 does not ban stock imagery outright, but any image that implies it shows your building, rooms or grounds has to be your building, rooms or grounds. The safe rule for a build is simple: people and abstract imagery can be licensed, places must be photographed.

Scope and location. City landing pages are the usual offender. A page titled for a city where you have no facility, written to read as though you treat people there, is exactly the misrepresentation of location the standard names. Standard 13 repeats the point for ads: you may not claim to operate where you do not provide services. A page that says you serve families from a city and explains where the facility actually is reads differently from a page that implies a clinic down the street.

Privacy: a posted policy, and forms that match it

Standard 10 asks for compliance with the privacy laws that apply to you and a posted privacy policy when the law requires one, and it names HIPAA for US programs that collect, store or transmit protected health information. In our census, 42 of 44 pages linked to a privacy policy or a notice of privacy practices, so the link itself is rarely the gap.

The gap is usually what happens behind the form. An insurance verification form that asks for a member ID and a date of birth is collecting health information, and the policy that sits in the footer has to describe what the site really does with it. We wrote up the mechanics of forms, hosting and vendor agreements in our guide to what a HIPAA compliant website involves. For LegitScript purposes, the short version is that the privacy policy is a factual document, and a reviewer can read it next to your intake form.

Claims a reviewer can ask you to prove

Standard 16 requires that all practices and offers be accurate, transparent and not misleading, including any material detail about the facility. That sentence is broad on purpose, and outcome claims are where it bites. Two of our 44 pages published a percentage. One set symptom improvement figures beside a button labeled "see how we measure success". The other said more than 80 percent of clients who finish its program remain sober, with no method on that page.

We will not guess how LegitScript treated either one, because its standards do not list forbidden phrases. What the standard does make clear is the test: if the number is material to a family's choice, you need to be able to show where it came from. A number with a published method is a claim you can defend. A number without one is a claim you are hoping nobody asks about.

The same logic covers insurance language. LegitScript's standards never mention the phrase "all major insurance", and 14 pages in our census used a version of it. One of the three that said all added, in the same sentence, two plans it does not accept. That is the shape to copy. A family on a plan you do not take should find out on your page, not on the phone after an hour of paperwork.

Standard 11 adds one clinical claim to watch: you may only use, recommend or promote drugs permitted by the relevant regulators. Service pages that describe medication-assisted treatment should name approved medications and avoid promising what an unapproved therapy will do.

Travel, rent and the incentive line

Standard 14 says programs that offer incentives such as paying for travel will generally not be approved, and it names paying a patient's rent or health insurance premiums during treatment as other problems. Every incentive you offer has to be disclosed to LegitScript regardless.

Three pages in our census offered help with travel: arranging flights, ground transport or airport pickup for people coming from out of state. None of the three said it pays for that travel. That distinction is the whole issue. Coordinating logistics is admissions work. Covering the fare is an incentive. If your page says "travel assistance" and your staff sometimes cover a flight, the page is describing something the application has to disclose, and the wording should say exactly which one you do.

The safest build choice is to describe travel help in verbs that are true every time, such as coordinate, arrange and schedule, and to keep words like free, covered and paid off any page that touches admissions unless a lawyer has cleared the practice behind them.

Other businesses' names cost one operator $7 million on paper

Standard 13 requires that ads clearly identify your own business and never use third-party business names. The Federal Trade Commission showed what that looks like when it goes wrong. In a June 2025 settlement, the FTC said Florida-based Evoke Wellness used the names of other clinics as keywords, placed those names in Google ads with its own call center number, and had telemarketers pose as a central admissions office or hotline that claimed a relationship with the clinic the caller wanted.

The stipulated order, filed for a federal judge's approval, imposes a $7 million civil penalty, partially suspended to $1.9 million because the defendants could not pay the full amount, and bans them from using rivals' names in search-engine ads. The FTC brought the complaint under both the FTC Act and the Opioid Addiction Recovery Fraud Prevention Act of 2018.

The first case under that law, announced in May 2022, is the other half of the lesson. The FTC said R360 told people it would match them with treatment centers chosen through a rigorous review by an addiction expert, when its owner, who lacked relevant qualifications, did only cursory reviews and did not verify what providers claimed. The $3.8 million penalty was suspended for inability to pay. The claim that got a company sued was a sentence about how carefully it vetted providers.

For a website, both cases point at the same pages: the admissions page, the insurance page and anything titled "hotline". Say whose phone line it is. Say who answers. If you work with a call center, the page should not let a caller believe they have reached someone neutral.

Every domain you own is in scope

This is the requirement that surprises owners most. LegitScript's list of what you need before applying says to list all domains you own, even those not being certified, and Standard 15 repeats that the applicant must provide all domain names and websites under its control. Standard 15 also says affiliates and partners must meet the standards, and Standard 12 prohibits co-ownership of, or informal affiliation with, a lead generator, including sponsoring or answering its hotline.

So the review is not only the site you are certifying. It is the old site still live on a previous brand name, the city microsites a past agency built, the "best rehabs in" blog someone registered years ago and pointed at your number. If any of those reads like a referral directory that routes to you, it can look like exactly the lead generation relationship Standard 12 prohibits.

Standard 5 widens the net again: you disclose every physical property and corporate entity under your control or to which you refer participants. Pages that promote a sister program, a sober living partner or an outpatient affiliate need to be accurate about that relationship, because the reviewer already has the list.

What certification costs, and why the page comes first

For one to nine facilities, LegitScript charges $1,595 per facility to apply and $3,095 per facility each year once approved, so $4,690 for one facility in year one. The per-facility rates step down to $1,495 and $2,775 at ten to 24 facilities and to $1,395 and $2,550 at 25 or more. Expedited review, started within two business days, costs another $2,500 per application.

Small practices can qualify for individual practitioner pricing, $535 to apply and $1,070 a year, if they have three or fewer client-facing practitioners, one location, one website with addiction treatment content and no affiliation with a larger organization. LegitScript says it cannot make exceptions to those limits. One note on the source: on the day we read them, the certification page still showed three volume tiers, while the FAQ showed a single standard tier for one to nine facilities and pointed operators with ten or more to its Enterprise program. Ask which applies before you budget.

The detail that should change the order of your work is in the refund terms. The application fee is nonrefundable regardless of outcome, annual fees are nonrefundable, and there are no prorated refunds. An application sent while the website still shows a city page for a location you do not operate is an application you may be paying for twice. Fix the pages, then apply.

Timing matters too. LegitScript says its certification is the one Google, Meta, Microsoft and Nextdoor recognize, but its FAQ says certification does not guarantee advertising approval. Google's addiction services policy still requires a separate application to Google, and Meta's policy says US advertisers must be certified with LegitScript and also apply to Meta for permission. Budget the weeks for both, and for the rebuild, before a launch date gets promised to anyone.

After approval, the website is still under review

Certification is not a one-time inspection. LegitScript's FAQ asks certified programs to email within 30 days of significant changes: new or dropped services, licensure or accreditation changes, provider discipline, government investigations, warning letters and similar actions. Adding a location does not need a new application, but it does need a compliance review and an application fee, and its first annual fee is cut by 50 percent if it is approved within six months of your renewal date.

For the website team, that turns into a release rule. A new service page, a new location page or a new domain is a change LegitScript may need to hear about, so it should not ship on a Friday afternoon because a campaign starts Monday. Put the certification contact in the launch checklist, next to the analytics check.

On Google, policy problems usually surface as disapproved ads, not a sudden ban: the policy page says violations will not lead to account suspension without a warning at least seven days beforehand, and an edited ad is typically re-reviewed within 24 to 48 hours. That window is only useful if the person who gets the warning can change the landing page the same day.

A pre-application page check

Run this against your own site before you pay the application fee. Each row names the standard it comes from, so you can read the original wording yourself on LegitScript's page.

Where a website cannot help

If you run a sober living home without licensed clinical services, a lead generation site or an assessment-only service, LegitScript's FAQ says you are generally not eligible, and no page copy changes that. If the obstacle is a license gap, an ownership tie to a lead generator or a disciplinary history, you need a healthcare lawyer before you need a designer, and anyone who sells you a site as the fix is selling you the wrong thing.

Where we are useful is the part a reviewer reads: location pages, service pages, photography plans, forms and the copy around insurance, travel and outcomes. We have built for five treatment centers, and after our redesign Cornerstone Healing Center saw 20 percent more website conversions. A LegitScript pre-check is listed among the add-ons on our pricing page for teams that only want the review, and our work for addiction treatment and recovery programs covers the rebuild when the review turns up more than copy edits. If you are still budgeting the build, our breakdown of what a treatment center website costs puts certification in that budget, and filling beds without buying leads covers the channels that do not depend on ads at all.

Start with a domain inventory

Before anyone edits a page, build one spreadsheet, because the application asks for most of it anyway. It takes an afternoon and it tends to surface the one site nobody remembered.

1. Every domain. Pull the list from your registrar account, your old agency's invoices and a search for your phone number. Note which ones are live, redirected or parked.
2. Every facility. One row per location that delivers services, with the street address exactly as it appears on the license and the lease.
3. Every page that names a place. Location pages, city pages and any page title with a city in it, marked against the facility rows. Anything without a match gets rewritten or removed.
4. Every service claim. The levels of care and populations each page mentions, checked against what the application will say.
5. Every number and offer. Percentages, insurance statements and anything involving travel, with a column for where the proof lives.
6. Every phone number. Who answers it, and whether any of those lines is presented as a hotline.

When every row reconciles, the website is ready to be read by a stranger with your license in their other hand, which is the review you are about to pay for.