Treatment Center Website Checklist: 31 Things to Fix Before You Run Ads
Oct 5, 2026 · 17 min read
Most treatment centers find out their website was not ready for ads after the money is already moving. An ad gets disapproved on day two. The certification application stalls because a domain was left off the form. A month of clicks lands on a page where the phone number goes to a voicemail box that is full. None of these are design problems in the usual sense, and all of them are cheaper to fix before launch than after.
This is the checklist we would want a center to run before it spends its first dollar on Google or Meta. It has 31 items in six groups. Every item traces to a rule an ad platform, a certifier or a regulator has published, or to a failure we can see from outside. To keep it honest, we tested the items we could measure against the homepages of 37 treatment providers on 5 October 2026, and the results sit next to each item.
The checklist, in short
Before a treatment center runs paid search or social ads, its website has to clear six gates. First, eligibility: Google and Meta both require LegitScript certification for US addiction treatment ads, plus their own approval, and LegitScript's standards cover what the site says. Second, the landing page must load for Google's crawler and stay on your own domain. Third, the phone number must be real, verified, answered and consistent. Fourth, the page must name your levels of care, insurance, licenses and admissions steps. Fifth, tracking must not hand health information to ad vendors. Sixth, it must be fast, accessible and cleanly coded. All 31 items are in one table further down.
Where the 31 items come from
We started from the rules, not from opinions about good design. Google's Healthcare and medicines policy and its destination requirements say what an ad and its landing page must do. Meta's restricted goods policy covers addiction treatment ads. LegitScript publishes the 16 standards behind its Addiction Treatment Certification, and two of them speak directly to the website. HHS has guidance on tracking technology and a disability rule with web deadlines. W3C and Google's web.dev team publish the accessibility and speed thresholds. Anything that could not be tied to one of those sources stayed off the list.
Then we checked what we could. On 5 October 2026 we ran searches for drug rehab, addiction treatment and detox centers in a dozen large US metros, from Boston and Philadelphia down to Miami and Atlanta, across through Chicago, Nashville, Dallas, Houston and Denver, and out to Phoenix, Los Angeles and San Diego. We kept treatment providers, dropped directories, hospitals and government pages, and requested 50 provider homepages the way a plain browser would. Thirteen did not give us a page: 11 answered with a block or a bot challenge, one with a server error, and one timed out. That left 37 homepages, which we read for the checklist items visible in their HTML. One more caution before the numbers: some sites draw part of the page with scripts after it loads, so a count from the source is a floor. We name none of the 37 sites here. The point is the pattern, not a ranking.
Eligibility: can you advertise at all? Items 1 to 7
For a US addiction treatment provider, the first question is not whether the site converts. It is whether the platforms will let you advertise. Google's answer is short. In its US rules, a provider of recovery-oriented addiction services needs LegitScript certification first and Google's own healthcare certification second. Services that are not eligible for LegitScript certification are not allowed to advertise them on Google at all. The same policy bans ads for prescription opioid painkillers and lists certified US addiction treatment providers among its narrow exceptions, so certification is what separates a treatment ad from a prohibited one.
Item 1: LegitScript certification is active for the facility you will advertise. Meta's addiction treatment policy asks for the same certification, plus written permission from Meta requested through its own form. On 22 of the 37 homepages we read, a LegitScript seal or a mention of LegitScript appeared in the source. The other 15 may well be certified. It does mean a family, or a reviewer, cannot see it.
Items 2 and 3: the platform approvals. LegitScript is the first gate, not the last. Google's healthcare certification is a separate application made inside your ads account, and Meta's written permission is a separate request. Budget the time for both. LegitScript sells expedited processing for $2,500 per application, which starts review within 2 business days of submission, and nobody pays that unless they are waiting on it.
Item 4: every domain you control is on the application. LegitScript's standards require applicants to provide all domain names and websites under their control, and its checklist says to list them even when they are not being certified. This bites centers that launch a separate landing page domain for ads. LegitScript also asks certified clients to report significant changes within 30 days, so a new domain after approval is not a quiet change.
Items 5 to 7: what LegitScript reads on the site. Under standard 9, a reviewer looks for each treatment address shown prominently, a specific account of what you treat, photos that are genuinely of your own facility, and nothing that overstates where or what you provide. Standard 13 adds that ads may not use third-party business names or claim locations where you do not treat, and under standard 14, perks like paying a patient's travel or rent will usually sink an application. In our census, 29 of 37 homepages showed a street address or ZIP code in the page text. The other eight were mostly multi-site brands that keep addresses on location pages, which can work, as long as the page your ad points to carries the address of the facility it promotes.
Certification is also the first real cost on this list. LegitScript lists a nonrefundable application fee between $1,395 and $1,595 for each facility, then a yearly certification fee between $2,550 and $3,095 for each facility, with the lower rates going to larger operators. A practice with no more than three providers, a single location and a single website qualifies for a reduced tier, priced at $535 for the application and $1,070 for each year. The full review, standard by standard, is in our earlier piece on LegitScript's website requirements.
The landing page: does it load for Google? Items 8 to 12
Google reviews the page your ad points to with its own crawler, AdsBot, and disapproves destinations that return an HTTP error to that crawler on common devices. Destination problems at least come with notice: Google says it warns at least 7 days before suspending an account over them. Still, a disapproved ad earns nothing while you fix it, which makes item 8 the one worth checking first: the final URL must load for Google's crawler, not just for you. Security tools that challenge unfamiliar visitors can get this wrong. In our census, 11 of the 50 provider sites answered our plain request with a block or a bot challenge page, and one more returned a server error. We are not Google, and a firewall may well treat AdsBot differently from us. But the only way to know is to test it, and Google tells you how: its destination requirements explain how to override your browser's user agent in Chrome DevTools to imitate AdsBot.
Item 9: the domain stays the same from ad to page. Google disapproves ads when the display URL's domain does not match the final URL, when the final URL redirects to a different domain, or when a tracking template leads somewhere other than the final URL. Call tracking and landing page tools that bounce visitors through another domain are the usual cause.
Item 10: HTTPS everywhere. All 37 homepages in our census sent a plain http request on to https, which is good. Only 13 also sent the HSTS header, which tells browsers to use the secure version every time without asking. It is a one-line server setting, and a site that collects insurance details should have it.
Items 11 and 12: nothing in the way, and something worth reading. Google's destination experience rules disapprove pages that are unnecessarily difficult or frustrating to navigate, links that start a direct download, and ad experiences that break the Better Ads Standards. Its insufficient original content rule catches pages built mainly to show ads, copied from elsewhere, or designed only to send users on. For a treatment center that means a real page about your program, written for the family arriving from that ad, without a full-screen pop-up between them and the phone number.
The phone: the conversion that matters most. Items 13 to 17
For most treatment centers the phone call is the conversion, so the phone gets five items of its own. Item 13: the call button is visible before anyone scrolls. Pew Research Center found that 91% of US adults own a smartphone in its 2025 survey, so the phone is the first screen that matters. In our census, 35 of 37 homepages had a tap-to-call link in the source. That is the strongest result on the whole list, and it should be: it is the one thing every agency in this niche gets asked for first.
Item 14: one number per location, everywhere. Eleven of the 35 homepages with a call link carried two or more distinct numbers. Some of that is honest: a brand with several facilities lists several lines. Some of it is call tracking, which swaps numbers by traffic source. Neither is wrong on its own, but the family should see one number for the facility they are looking at, and the ad, the map listing and the page should agree on it.
Item 15: the number in the ad itself passes Google's rules. Numbers in call assets, call-only ads and location assets must be in service in the targeted location, relate to the advertised company, and be verified by Google. Google also disapproves fax, premium and vanity numbers, numbers that are not local or domestic, virtual phone number services, and numbers without an active voicemail service. That last rule surprises people. A full or switched-off voicemail box is a policy problem, not just a lost call.
Item 16: someone answers at 2 a.m., or the page says what happens. Of the 37 homepages, 26 used 24/7 or 24-hour wording somewhere. If you say it, staff it. If you cannot, say when someone will call back, because ads run at night whether admissions does or not. Our article on the admissions page that gets calls goes deeper on what that page should say around the number.
Item 17: the crisis line. Some of the people who click a rehab ad are in danger tonight, and admissions staff are not crisis counselors. Just 2 of 37 homepages named 988, the national suicide and crisis lifeline, which anyone can call or text. A single line near the phone number, pointing to 988 and to 911 for emergencies, costs nothing and is the right thing to do.
What the page says: answer the family's questions. Items 18 to 23
A paid click is a family with a specific question, and the page has to answer it. Item 18: name the levels of care. LegitScript's standard 9 already requires the specific nature of the services, so detox, residential, partial hospitalization, intensive outpatient and outpatient should each be named where they apply, matching your license.
Item 19: insurance, plainly. On 34 of 37 homepages there was a link to an insurance or verification page, and 24 named at least one major insurer in the source. Name the plans you are in network with, and give one route to a benefits check. A family that has to guess whether you take their plan calls the next ad instead.
Item 20: license and accreditation a family can check. Nineteen homepages mentioned the Joint Commission and 6 mentioned CARF. Naming the accreditor is half of it. The other half is making sure the program names on your site match the ones in the accreditor's lookup.
Item 21: the admissions steps, written out. Twenty-eight of the 37 homepages had a form in the source. A short form that asks only what admissions needs to call back is better than a long one that asks for a member ID before anyone has spoken to the family.
Items 22 and 23: the words around the click. Five homepages had no meta description, and 10 had titles longer than 60 characters. Those matter more for organic search than for ads, but the same page usually serves both. Item 23 is the ads version of the same idea: the detox ad lands on the detox page, the IOP ad on the IOP page. Google's landing page experience rating exists to measure whether the page is relevant and useful to the person who clicked, and a generic homepage rarely is. Our conversion optimization service is built around exactly that match.
Tracking and privacy: where ad money gets risky. Items 24 to 28
This is the group where treatment centers take on real legal risk, and the honest answer is that the rules have moved. HHS issued guidance on tracking technologies, and in June 2024 a federal court in Texas vacated part of it: the part holding that HIPAA applies whenever a tracking tool links someone's IP address to their visit to an unauthenticated page about health conditions or providers. What survives includes the example that matters most to a rehab: if someone makes an appointment through a covered clinic's website and third-party tracking sends that information to a vendor, HHS says the provider needs the disclosure to be permitted and a business associate agreement with that vendor. Federal regulators have enforced this outside HIPAA too. In March 2023 the FTC announced a $7.8 million settlement with BetterHelp, which it said shared email addresses, IP addresses and health questionnaire answers with Facebook, Snapchat, Criteo and Pinterest for advertising.
Item 24: list every tag. Of the 37 homepages, 27 loaded a Google Tag Manager container, which can fire any number of other tags that never appear in the page source. In the raw HTML we saw only 5 Google Ads tags and 3 Meta pixels, which tells you less about what runs than the Tag Manager count does. Export the container and write down what each tag sends and to whom.
Item 25: no vendor gets form or appointment data without a signed agreement. Submit a test form with fake details and watch your browser's network tab. If the name, phone number or insurance plan leaves for an ad or analytics vendor, either that vendor has signed a business associate agreement with you or the tag comes off that page.
Item 26: do not build the plan on remarketing. Google lists Health as a sensitive interest category in its personalized advertising policy, and its examples include counseling for addiction, alcohol addiction among them. Advertisers promoting products and services in sensitive categories cannot use advertiser-curated audiences, which includes customer lists and your own website visitor segments. Plan your campaigns around search intent instead, and you will not build something Google switches off.
Items 27 and 28: a true privacy policy, and conversions that carry no health details. LegitScript's standard 10 requires compliance with applicable privacy law and, where the law requires it, a posted privacy policy. Thirty-four of 37 homepages linked one. Read yours next to your tag list: if it says you do not share information with advertisers and Tag Manager says otherwise, one of them is wrong. Then make sure a call and a form fill each count as a conversion while sending the event, not the content. Eighteen of the 37 homepages loaded a call tracking script, which is the usual way calls get counted; confirm what that vendor records and whether it has signed an agreement with you.
Speed, access and code: the slow leaks. Items 29 to 31
The last three items rarely cause a disapproval. They cost money slowly instead, through clicks that bounce. Item 29: Core Web Vitals. Google's web.dev guidance sets good thresholds of 2.5 seconds for Largest Contentful Paint, 200 milliseconds for Interaction to Next Paint and 0.1 for Cumulative Layout Shift, and Google counts a page as passing only when three in four real visits meet every one of them, which is what the 75th percentile means here. Check the landing page itself, on mobile, in PageSpeed Insights.
Item 30: accessibility. WCAG 2.2 success criterion 2.5.8, at level AA, asks for pointer targets of at least 24 by 24 CSS pixels, with exceptions such as enough spacing around a smaller target. For centers that receive federal financial assistance from HHS, there is also a date. HHS's section 504 rule requires WCAG 2.1 level AA for web content, and an interim final rule effective 7 May 2026 pushed the deadline back a year: larger recipients, with at least 15 staff, now have until 11 May 2027, and smaller ones until 10 May 2028. Whether your payer mix makes you a recipient is a question for counsel, not for us.
Item 31: clean code where it is cheap. Four of the 37 homepages had at least one block of structured data that does not parse, from raw line breaks inside text to comments that JSON does not allow. Google's structured data documentation treats JSON-LD and the other supported formats alike, provided the markup is valid, so a block that fails to parse does nothing at all. Five homepages had more than one main heading, or none in the source. Neither stops an ad, both are a ten-minute fix, and both say something about how carefully the rest was built.
All 31 items in one table
Print this, or copy it into a spreadsheet and give each row an owner. The last column shows what our census found where an item was visible from outside; "not measured" means we could not test it honestly from a homepage.
| # | Check | How to check it | What our census found |
|---|---|---|---|
| Eligibility | |||
| 1 | LegitScript Addiction Treatment Certification is active for the facility you will advertise | Look your domain up in LegitScript's certification checker | 22 of 37 homepages show a seal or mention |
| 2 | Google healthcare certification is applied for inside the ads account | Google Ads policy manager shows the certification status | Not visible from outside |
| 3 | Meta written permission is requested if Facebook or Instagram is in the plan | Meta's permission request form | Not visible from outside |
| 4 | Every domain you control, including any new landing page domain, is on your LegitScript application | Compare your registrar's domain list with what you filed | Not visible from outside |
| 5 | Each facility's street address is on the site, where a visitor would see it | Open the page on a phone and find the address without searching | 29 of 37 homepages show an address or ZIP |
| 6 | Photos show your real facility and staff | Swap any stock photo of a campus that is not yours | Not measured |
| 7 | No pages for cities you do not treat in, no other company's brand name, no paid travel offers | Read your location pages and ad copy against where you actually treat | Not measured |
| The landing page | |||
| 8 | The final URL loads for Google's crawler, not just for you | Override your browser's user agent to AdsBot in Chrome DevTools and load the page | 13 of 50 sites refused or failed our plain request |
| 9 | The ad's display domain and the final URL are the same domain, with no redirect to another one | Click through your own tracking template and watch the address bar | Not measured |
| 10 | HTTPS is forced, and the HSTS header is set | Type http:// before your domain; check response headers | 37 of 37 forced HTTPS; 13 set HSTS |
| 11 | Nothing blocks the page on arrival: no full-screen pop-up, no automatic download | Load the page on a phone with cookies cleared | Not measured |
| 12 | The page is about your program, in your words, not a thin page built to catch clicks | Read it as a parent: does it say what you treat and where? | Not measured |
| The phone | |||
| 13 | A tap-to-call link sits on the first screen of a phone | Load the page at phone width and look before scrolling | 35 of 37 homepages had a tel link |
| 14 | Each location has one number, and the page, the ad and the map listing agree | List every number on the page and in each listing | 11 of 35 showed two or more numbers |
| 15 | The call asset number is verified by Google, local or domestic, not a virtual or vanity number, with voicemail on | Call it from a phone that is not on your system | Not visible from outside |
| 16 | A person answers at 2 a.m., or the page says what happens after hours | Call at 2 a.m. on a weekday | 26 of 37 used 24/7 or 24-hour wording |
| 17 | The 988 crisis line and 911 are on the page for anyone in danger right now | Search the page text for 988 | 2 of 37 named 988 |
| What the page says | |||
| 18 | The levels of care offered are named: detox, residential, PHP, IOP, outpatient | Compare the page with your license | Not measured |
| 19 | The insurance plans you take are named, with one clear way to verify benefits | Count the steps from the ad to a verification form | 34 linked insurance; 24 named an insurer |
| 20 | License and accreditation are named, so a family can check them | Search your center on the accreditor's lookup | 19 named the Joint Commission; 6 CARF |
| 21 | The admissions steps are written out, and the form asks only what admissions needs | Count required form fields | 28 of 37 homepages had a form |
| 22 | The title and meta description are written for this page and fit in a result | Search your own page on a phone and read the result | 32 had a description; 10 titles ran past 60 characters |
| 23 | The page delivers what the ad says: the detox ad lands on detox | Match each ad group to its final URL | Not measured |
| Tracking and privacy | |||
| 24 | Every tag on the site is listed, including what Tag Manager loads | Open Tag Manager and export the container | 27 of 37 used Tag Manager |
| 25 | No ad or analytics vendor receives form or appointment data without a signed business associate agreement | Submit a test form and watch the network tab | 5 Google Ads tags and 3 Meta pixels in raw source |
| 26 | Your plan does not rely on remarketing lists or uploaded customer lists | Check the audiences in the account | Not visible from outside |
| 27 | A privacy policy is linked on every page and describes what the site really collects | Read it next to your tag list | 34 of 37 linked one |
| 28 | Calls and form submissions count as conversions without sending health details | Place a test call and a test form; check the conversion and the payload | 18 used call tracking |
| Speed, access and code | |||
| 29 | The page passes Core Web Vitals on phones: LCP 2.5 s, INP 200 ms, CLS 0.1 | PageSpeed Insights field data for the URL | Not measured |
| 30 | Tap targets are at least 24 by 24 pixels, and the page is built to WCAG 2.1 AA | Tab through the page; test with a screen reader | Not measured |
| 31 | Structured data parses, and the page has one main heading | Google's Rich Results Test; view source | 4 of 37 had broken JSON-LD; 32 had one h1 |
Where KhanWork earns its fee, and where it does not
A good share of this list is admin, not design. Items 1 to 4 are forms and phone calls with LegitScript, Google and Meta. Item 16 is a staffing decision. Item 26 is a campaign setting your ads manager controls. We do not manage ad spend in any of our tiers, so if most of your gaps sit there, you need a paid media specialist with LegitScript experience more than you need us.
Where we help is the website half: the address, services and photo standards, the landing pages that match each ad group, phone placement, insurance and admissions pages, a tag inventory with the vendors that should not be on form pages taken off, and the speed and accessibility work. Before a center applies to LegitScript or renews, our LegitScript Website Pre-Check is a page-by-page review with a written fix list for $499. If the work goes further, our three tiers are monthly subscriptions listed on the pricing page: $1,000 a month for Foundation, which delivers a brand refresh and a landing page and then adds a page each month; $2,500 for Growth, which covers the whole website; and $5,000 for Scale, for operators with several locations. You can pause or cancel any month. On every tier, the first page goes live within 14 business days of the day your copy and photos arrive, or the following month is on us.
For background: our team has shipped over 200 projects, 5 of them for treatment centers, and Cornerstone Healing Center's website conversions went up 20% after we redesigned it. Our addiction recovery industry page sets out how we work with centers. If you would rather start with a second pair of eyes than a proposal, ask for a free funnel review of the page your ads will send people to, and we will tell you which of the 31 items it fails.
The AdsBot rehearsal
You can test the most expensive failures yourself in about half an hour, before any campaign goes live, with nothing but Chrome on a laptop and your own phone.
- Load the landing page as Google's crawler. In Chrome DevTools, open the network conditions panel, untick the default user agent, and enter AdsBot's. Reload the page. If you see a challenge, an error or a blank page, talk to whoever runs your firewall before you talk to anyone about ad copy.
- Follow the click. Paste the full tracking URL you plan to use into a private window and watch the address bar. It should end on your own domain, on the page the ad promises.
- Call the number from a phone that is not yours. Once during office hours and once after 10 p.m. Note who answers, and if nobody does, whether voicemail picks up and has room.
- Submit the form with fake details. With the network tab open, watch where the data goes. Write down every domain that receives it.
- Read the page as a parent would. On your phone, can you find the facility's address, the levels of care, whether they take your plan and what happens next, without scrolling past the first two screens? Is 988 there for someone who cannot wait?
If all five pass, you have cleared the failures that cost the most. If any fail, fix them first, because every one of them gets more expensive once the ads are running.
Frequently asked questions
Active LegitScript certification and Google's own healthcare certification, a landing page that loads for Google's AdsBot crawler on your own domain, a verified local phone number with voicemail, and the facility address and services stated plainly. After that come insurance and admissions details, tracking that sends no health data to ad vendors, and a fast, accessible page. Our 31-item table covers each one.
Yes. Both Google and Meta require it before a US provider can advertise drug and alcohol addiction treatment. Google also requires a separate certification with Google, and Meta requires written permission requested through its own form. Services that are not eligible for LegitScript certification cannot advertise them on Google at all.
For one to nine facilities, $4,690 per facility: a $1,595 application fee plus a $3,095 annual fee, as published on 5 October 2026. Larger operators pay less per facility, down to $3,945 at 25 or more. A small practice tier for one to three providers, one location and one website costs $535 plus $1,070. Expedited review adds $2,500 per application.
Usually because Google's AdsBot crawler got an error, a bot challenge or a redirect to another domain when it tried to load the final URL. Load the page with your browser's user agent set to AdsBot in Chrome DevTools, follow your tracking URL to the end, and check that it stays on your own domain. In our census, 13 of 50 rehab sites refused or failed a plain request.
Generally no. Google lists Health as a sensitive interest category, with addiction counseling among its examples, and advertisers promoting in sensitive categories cannot use advertiser-curated audiences such as customer lists and website visitor segments. Predefined Google audiences remain available because they exclude sensitive signals. Build campaigns on search intent instead.
Not on pages where people submit forms or book appointments, unless the vendor has signed a business associate agreement with you. HHS guidance says tracking that sends appointment details to a vendor needs a permitted disclosure and a BAA, and in 2023 the FTC settled with BetterHelp for $7.8 million over health data shared with ad platforms. Test every form with fake details first.
No rule we found requires it, but we recommend it. Some people who click a rehab ad are in crisis, and admissions staff are not crisis counselors. One line near the phone number pointing to 988, the national suicide and crisis lifeline, and to 911 for emergencies costs nothing. Only 2 of the 37 homepages we read named 988.
If your center receives federal financial assistance from HHS, by 11 May 2027 with 15 or more employees, or 10 May 2028 with fewer. An interim final rule effective 7 May 2026 moved both dates back a year. Whether your funding makes you a recipient is a question for your lawyer. For everyone else, WCAG 2.1 AA is still the practical standard to build to.
RecoveryOct 1, 2026 · 17 min
How ChatGPT and Perplexity Recommend Treatment Centers: What 24 Answers Show
We asked ChatGPT where to find rehab in 12 US cities, recorded every center it named and every source it cited, then read 75 treatment center websites. Here is how the recommendation gets made.
RecoverySep 30, 2026 · 17 min
How to Choose a Treatment Center Marketing Agency: What 27 Agency Websites Show
We read the websites of the agencies that rank for treatment center marketing, including in Denver, and the Google, Meta and federal rules they work under. Here is what to check before you sign.
RecoverySep 29, 2026 · 16 min
Who Hosts and Maintains a Treatment Center Website? What 60 Rehab Sites Show
We looked up the host, domain, certificates and software behind 60 ranking rehab websites to show who should host and maintain a treatment center website, what it costs, and where HIPAA changes the answer.
