Buying CBD online is easy. Buying good CBD online takes about ten minutes of checking before you click “add to cart.” The market is loosely regulated, labels overstate what’s inside, and some products have failed independent testing for potency or contaminants. The good news is that the honest brands leave a paper trail, and you can read it. Here are eight things worth checking every time, in plain language, with no medical claims attached.
1. A current third-party COA you can actually open
A certificate of analysis (COA) is a report from an independent lab, not the brand’s own marketing. The first test is simple: can you find it and open it? Good brands link the COA on the product page or print a QR code on the bottle. If you have to email customer service, dig through a locked portal, or settle for a blurry screenshot with details cropped out, treat that as a warning. “Current” matters too. A COA from three years ago tells you nothing about the batch shipping today. If you’ve never read one, our guide on how to read a COA covers the same panels that apply to CBD.
2. The COA matches the batch
A report only counts if it describes the product in your hand. Look for a batch or lot number on the COA and match it to the number on the bottle or product page. Brands sometimes post one flattering COA and reuse it across every batch, which defeats the point. If the numbers line up, you’re looking at real, batch-specific testing. If there’s no batch number anywhere, you can’t confirm the report belongs to your product.
3. Cannabinoid potency in mg, and total THC under 0.3%
The COA should list cannabinoid potency in milligrams, not just vague percentages. Check that the CBD content roughly matches what the label promises. Studies over the years have found plenty of products that contained far less CBD than advertised, and a few that contained more. Then confirm total THC stays under 0.3% on a dry-weight basis, which is the federal line for hemp under the USDA hemp program. If you want the full breakdown of why that number matters, see our explainer on CBD vs hemp vs THC.
4. Full contaminant panels
Potency is only half the report. Hemp pulls contaminants out of the soil, so the COA should also test for what shouldn’t be there. Look for four panels: heavy metals (lead, arsenic, cadmium, mercury), pesticides, residual solvents left over from extraction, and microbials such as mold and bacteria. A potency-only report is a partial report. If a brand tests cannabinoids but skips contaminants, you’re trusting them on the safety questions that matter most.
5. Hemp source and farming
Where the plant grew shapes what ends up in the bottle. US-grown hemp falls under state and federal agricultural rules, and organic farming reduces the pesticide load before extraction even starts. Good brands say where their hemp comes from and how it’s farmed. Vague phrases like “premium hemp” with no origin are a soft red flag. Certified organic, named farms, or a specific growing region all beat a generic claim. Our hemp glossary entry explains the plant side in more detail.
6. Extraction method disclosed
How the CBD is pulled from the plant affects what’s left behind. CO2 extraction is common and clean: it uses pressurized carbon dioxide rather than chemical solvents, and it leaves little residue. Ethanol extraction is also widely used and can be done well. The point isn’t that one method is always best; it’s that a transparent brand will tell you which one it uses. Silence on extraction, paired with no residual-solvent panel on the COA, is a combination worth avoiding.
7. Clear, honest labeling and no disease claims
Read the label and the product page with a skeptical eye. Honest labeling means the cannabinoid content per serving, the spectrum type (full-spectrum, broad-spectrum, or isolate), the serving size, and an ingredient list. What you should not see is medical language. If a brand says its CBD treats, cures, or relieves a specific condition, it’s making claims the FDA does not allow for these products, and it’s a sign the company is willing to cut corners on compliance. The FDA’s consumer page on CBD spells out why those claims are a problem.
8. Certification and a real return policy
Two final signals tie it together. U.S. Hemp Authority certification (or a comparable program, or USDA organic) means a third party has audited the company’s process, not just a single batch. And a clear return policy tells you the brand stands behind what it ships. A business that takes your money but won’t take the product back if something’s wrong is telling you how much it trusts its own quality. For more on testing specifically, read our piece on the signs a brand is genuinely third-party tested.
Quick checklist
Run through these before you buy. If a product clears all eight, you’re on solid ground. If it misses several, keep shopping.
| Check | What “good” looks like |
|---|---|
| 1. COA access | Linked on the page or QR code, easy to open, recent |
| 2. Batch match | Lot number on COA matches the bottle |
| 3. Potency and THC | CBD in mg matches label, total THC under 0.3% dry weight |
| 4. Contaminant panels | Heavy metals, pesticides, solvents, microbials all tested |
| 5. Hemp source | US-grown, named region or farm, organic where possible |
| 6. Extraction | Method disclosed (CO2 is common and clean) |
| 7. Labeling | Clear servings and spectrum, no disease claims |
| 8. Certification and returns | U.S. Hemp Authority or similar, plus a real return policy |
Green flags vs red flags
| Green flags | Red flags |
|---|---|
| Batch-specific COA linked on the product page | No COA, or a cropped screenshot with no batch number |
| Full contaminant panels alongside potency | Potency only, no contaminant testing |
| Named hemp source and disclosed extraction | “Premium hemp” with no origin or method |
| Honest labeling, spectrum stated, no medical claims | Claims to treat, cure, or relieve conditions |
| Recognized certification and a clear return policy | No certification and no way to return the product |
Putting it to work
None of this requires a chemistry background. It requires a few minutes and a willingness to walk away from a brand that won’t show its work. The companies doing this right make it easy on purpose, because transparency is their selling point. If you want a head start, our roundup of the best full-spectrum CBD brands of 2026 has already done the COA reading for several names, and our brand directory and reviews go deeper. You can also browse the CBD category for related guides or check the coupons page once you’ve picked a brand.
Frequently asked questions
What is a COA and why does it matter?
A certificate of analysis is an independent lab’s report on a specific batch of product. It confirms cannabinoid potency, checks that total THC stays under the legal limit, and screens for contaminants. It matters because the label alone isn’t verified, and the COA is the closest thing to proof of what’s actually in the bottle.
How do I know the COA is real and current?
Check that it comes from a named third-party lab, carries a recent date, and shows a batch number that matches the product you’re buying. A report with no lab name, no date, or no batch number can’t be confirmed. Some brands also let you scan a QR code that pulls up the exact batch.
Why does the 0.3% THC limit keep coming up?
In the US, hemp is legally defined as cannabis with no more than 0.3% delta-9 THC on a dry-weight basis. Products above that line aren’t hemp under federal law. Checking the COA confirms the product stays within that limit, which is both a legal and a quality signal.
Is CO2 extraction actually better?
CO2 extraction is common and clean because it uses pressurized carbon dioxide instead of chemical solvents, leaving little residue. Ethanol extraction can also be done well. The bigger point is disclosure: a brand that tells you its method and tests for residual solvents is being transparent, whichever method it uses.
Should I avoid full-spectrum if I get drug tested?
Full-spectrum products contain trace THC under the legal limit, which can sometimes trigger a positive on sensitive tests. If you’re tested for work, broad-spectrum or isolate carries less risk, though no product can be promised to be undetectable. Read the COA and weigh your own situation.
Editorial note: This article is for general information only and is not medical or legal advice. These products have not been evaluated by the FDA to diagnose, treat, cure, or prevent any disease. Laws vary by location and change often, so verify the rules that apply to you. Always talk to a licensed healthcare provider before use, especially if you are under 21, pregnant or nursing, taking medication, or managing a health condition.
It also helps to know going in that CBD itself carries no addiction risk. See Is CBD Addictive? for the full explanation.