Online store launch checklist for dispensaries.
Everything to settle before a dispensary, CBD or hemp store takes its first online order. Work through it top to bottom; each step depends on the one before.
The short version
- Rules first: what you may sell online, to whom, and how it may be handed over or shipped in each state.
- Then the gates: age checks, patient records for medical products, and shipping limits per product.
- Then payment and menu: how customers pay, and one inventory source for the register and the website.
- Then getting found: paid ads are mostly closed to cannabis, so product pages, local search and AI answers carry the load.
1. Rules and scope
- List what you will sell online and split it: licensed THC products, hemp and CBD, accessories and merch. Each group has different payment and shipping rules.
- Write down your state's rules for online orders. Pickup only or delivery, ID checks at handover, purchase limits, and whether prepayment is allowed. Rules differ a lot between states.
- Check the hemp dates. The new federal hemp definition takes effect November 12, 2026 for synthetic cannabinoids and December 11, 2026 for the rest. Remove products that will no longer qualify.
2. Age checks
- Put an age gate in front of the store. A yes or no question or a date of birth, with 21 as the usual minimum for adult-use products.
- Back it up at checkout. A gate on the homepage is easy to skip. Covered products should not reach the cart without a pass.
- Keep search engines able to read the site. Let crawlers through so your pages can still be indexed.
- Check ID again at handover for pickup and delivery, as your state requires.
Our Age Gate plugin does all of the online steps above. It costs $49 a year: see Age Gate.
3. Patient records
- Decide which products need a medical record. Flag them, so the rule applies only where it should.
- Collect the recommendation and ID. Store the files privately, never in a public media library.
- Review before the first order. A person approves each record, and the expiry date is checked on every later order.
- Decide how long you keep the files and who on your team may open them.
Our Patient Registration plugin handles the upload, review and expiry checks. It costs $49 a year: see Patient Registration.
4. Shipping and delivery limits
- Map each product to where it may go. By state, and where needed by ZIP code or city.
- Apply the rule at checkout, from the shipping address, with a clear message instead of a silent failure.
- Keep local pickup separate. Pickup orders should not be blocked by shipping rules.
- Review the lists whenever a state changes its rules or you add a product.
Our Shipping Limits plugin applies these rules per product or category. It costs $49 a year: see Shipping Limits.
5. Payments
- THC products: cash at pickup or delivery, and pay by bank (ACH) where a provider supports your setup. Cards are not an option for these sales.
- CBD, hemp and accessories: a processor that underwrites them. Stripe restricts CBD, WooPayments does not allow it, and Square is ending CBD and hemp on October 15, 2026.
- Have a terminal but no gateway? Take card orders online and charge them on the terminal, if your account covers the products and allows keyed entry.
- Test every payment path with a real order and a refund before launch.
Details in our payment options guide and CBD and hemp processor guide.
6. Menu and inventory
- One source of truth. The website menu should read the same stock count as the register, or you will sell what you do not have.
- Pick the setup: your POS vendor's embedded menu, a plugin that syncs the POS into WordPress, or a WooCommerce store for non-THC products.
- Check the plugin is maintained. Look at the last update date before you rely on it.
Compare vendors in our POS and menu software guide.
7. Product pages
- Real photos and plain descriptions. Strain or product type, size, THC and CBD content.
- Lab results linked from each product. Underwriters and customers both look for them.
- No health claims. Describe the product, not what it treats.
- Policies in the footer. Shipping, refunds, privacy, terms and how to reach you.
8. Getting found
- Expect little from paid search. Google allows only topical, hemp-derived CBD with 0.3% THC or less, certified by LegitScript, and only in California, Colorado and Puerto Rico.
- Claim and complete your Google Business Profile with hours, photos and the same name, address and phone as your website.
- Write pages that answer real questions. AI assistants quote clear facts: what you sell, where you deliver, how payment works.
- Add structured data for your store, products and FAQs so search engines read the facts correctly.
9. Email and texts
- Do not plan on mainstream SMS. Twilio lists businesses associated with cannabis and CBD among those that cannot use its SMS and MMS routes. Cannabis-focused marketing tools exist for this.
- Read your email platform's acceptable use policy before importing customers.
- Collect consent at checkout and keep proof of it.
10. Launch day
- Place a test order for every path: pickup, delivery, shipping, each payment method, a declined payment and a refund.
- Check on a phone. Most customers will order on one.
- Check the emails customers receive and that none contain card numbers or private documents.
- Set up analytics so you can see where orders come from in the first weeks.
Want this done for you?
We build WooCommerce stores for dispensaries, CBD and hemp shops, with the age, patient, shipping and payment pieces already in place.
Questions
Do I need an age gate on a dispensary website?
Adult-use cannabis is sold only to people 21 and over, so the usual setup is an age gate on the site, an age rule at checkout and an ID check at pickup or delivery. Check what your state requires online.
Can I advertise a dispensary on Google?
Not for THC products. Google allows only topical, hemp-derived CBD with 0.3% THC or less, certified by LegitScript, and only in California, Colorado and Puerto Rico.
Can I send text messages to dispensary customers?
Not through mainstream SMS providers such as Twilio, which bars cannabis and CBD businesses from its SMS routes. Cannabis-focused marketing platforms are the usual alternative.
Sources
- Google Ads policy, CBD. support.google.com/adspolicy/answer/12997469
- Twilio, Error 30469. twilio.com/docs/api/errors/30469
- Congressional Research Service, IF13136, updated September 28, 2026. everycrsreport.com
- Stripe, Prohibited and restricted businesses. stripe.com/legal/restricted-businesses
- WooCommerce, WooPayments CBD policy. woocommerce.com/document/woopayments/our-policies/cbd
- Marijuana Moment, Square CBD and hemp notice, August 7, 2026. marijuanamoment.net
All sources checked October 12, 2026. This checklist is general information, not legal advice. Your state's cannabis regulator has the final word on what applies to you.