A good med spa website does one job: it turns a phone visitor into a booked treatment. In practice that means a Book button and a tappable phone number on the first screen, one page per treatment with a price and the provider's credentials, real reviews, light pages, booking forms that don't ask health questions, and tracking that shows which pages produce bookings.

Most med spa sites miss at least one of these. When we scanned 749 med spa websites on a phone, 29.8% had no Book button on the first screen, 22.8% had no tap-to-call link and 37.1% weighed more than 3 MB.

This checklist is in the order we'd work through it. Each item says what to do and what tends to go wrong, with examples from work we did for Elume Medspa in Fairfax, Virginia.

Key takeaways
  • Put a Book button on the first phone screen of every page, and make it open the right service in one tap.
  • Give every bookable treatment its own page with price, provider, downtime and a booking link for that service.
  • Keep booking forms to logistics. Calendly's terms, for example, say customer data must not contain HIPAA-protected health information.
  • Track every step from button click to booked appointment, tag every booking link, and treat your booking system as the source of truth.
  • No before-and-after photos in paid ads. Google's clickbait policy bars them for significant changes to the body.

1. Put the Book button on the first phone screen

Open your site on your phone and don't scroll. If you can't see a way to book, neither can your patients. A sticky header with a Book button solves this on every page at once.

Make the button open booking directly. A button that goes to a contact page, or to a calendar where the patient has to find the service again, adds steps and loses people. The best version opens the booking tool in a popup, pre-set to the treatment on the current page.

From our work: For Elume Medspa we built a booking popup that opens the right Calendly service from any Book link on the site and loads Calendly's code only when someone clicks, so it adds nothing to page speed. In one measured window, 138 popup opens became 41 time selections and 13 bookings (9.4%). Calendly bookings went from 6 in August to 32 in September 2026. The popup launched alongside a priced booking page and the first email campaigns, so the site doesn't get all the credit, but it did its part.

2. Make the phone number tappable

Wrap your phone number in a tel: link everywhere it appears: header, footer, contact page and treatment pages. Some patients want to ask a question before they book, especially for a first visit or a large treatment. If tapping the number does nothing, you've made calling harder than leaving.

Check it on an actual phone. Website builders often render a phone number as plain text unless you use their dedicated phone or click-to-call element.

3. Build one page per treatment

A single "Services" page with a paragraph per treatment can't rank for "Morpheus8 near me" or answer the questions a patient has before paying for it. Each treatment that matters to your revenue needs its own page that covers:

  • What it is and what it's for, in plain words
  • Who it suits, and who shouldn't have it
  • How many sessions, how long each takes, and the typical downtime
  • Price, or a starting price
  • Who performs it, with their role and license
  • Questions patients actually ask your front desk
  • A Book button that opens that treatment, plus a consultation option

For treatments that always need a consultation first, offer a one-click "Book a free consultation" instead of a request form. On Elume's site we added exactly that to all 18 treatment pages that weren't directly bookable online.

4. Show your prices

Patients compare prices before they call. If your site won't say, the competitor's site that does gets the click. A starting price ("from $X per session") or a range is enough when the final price depends on a consultation.

Prices also help you in AI search. When we ran Morpheus8 cost and location questions through ChatGPT, Perplexity and Google AI Overviews for Elume, every engine that answered named the practice and quoted its published $549 and $695 prices word for word, citing the cost page. A page that hides the price has nothing to quote.

Watch out: Keep one price everywhere. If your website, booking tool, old booking storefronts, ads and in-office menu disagree, patients notice and checkout surprises lose bookings. Update them together, and take down booking pages on systems you no longer use.

5. State provider credentials accurately

Name who performs each treatment and give their actual role and license: "injections by a licensed physician assistant," not a vague "our experts." Patients look for this, and it's a trust signal on a medical page.

Accuracy matters more than impressiveness. On one med spa site we audited, a wrong credential had spread to about 40 places, including structured data and emails, and had to be removed everywhere. One sneaky source: the WordPress user bio field can feed author structured data on every blog post. A database search missed it; only crawling the rendered pages found it. When a credential changes, search the live pages, not just the editor.

6. Follow the rules on before-and-after photos

Before-and-after photos are powerful on a treatment page, and risky everywhere else.

  • On your website: use only your own patients' results, with their written consent for that use. Show typical results, not just your best one. Never present a device maker's marketing photo of another practice's patient as your own result. If you use one, label where it came from.
  • In ads: Google's clickbait ads policy doesn't allow ads that use "before and after" images to promote significant alterations to the human body (Google Ads clickbait policy). Other platforms have their own rules, and they change. Our house rule is simple: no before-and-after images in any paid ad, on any platform.

Patient photos may also be health information, depending on how your practice is set up. This is general information, not legal advice; ask your healthcare attorney how consent should work for you.

7. Keep pages light

Half the med spa homepages we scanned downloaded under 2.3 MB, but 37% were over 3 MB and 10% over 6 MB. The usual causes are camera-size hero photos, slideshows that load every slide up front, Instagram widgets and too many fonts. Resize the hero image to the size it actually displays, convert photos to WebP, and lazy-load anything below the first screen.

Measure with several runs, not one. Our first audit of Elume's site found a 786 KB icon file loading on every page. After a round of speed fixes, a treatment page went from 58 to 94 in mobile Lighthouse performance, and its lab LCP from 10.42 to 2.35 seconds (medians of three runs). We've also seen the opposite: cutting 367 KB from every page produced no measurable change, because single lab runs swing widely. Trust byte and request counts over any one score.

8. Design for thumbs, not mice

  • Tap targets at least 44 pixels tall, with space between them.
  • Contrast that passes on the actual background. "WCAG-safe" describes a color pair, not a color. On one of Elume's signup forms, the brand's link blue passed on white at 6.02:1 and failed on the form's tinted background at 3.66:1.
  • Nothing above the headline that shouldn't be there. We moved a booking panel that was rendering above a page's H1.
  • Pop-ups that don't cover the phone screen on arrival. A discount bubble on Elume's store once sat over the cart's Checkout button. Test every pop-up on a real phone before it goes live.

9. Keep booking forms HIPAA-aware

Many popular scheduling tools aren't built for health information. Calendly, for example, doesn't offer a HIPAA business associate agreement (BAA), and its customer terms say customer data must not contain "protected health information" (Calendly customer terms). So on Elume's Calendly events, booking questions stay logistics-only. No medical history, medications, conditions or intake questions.

If you need intake information before a visit, collect it in a system whose vendor will sign a BAA, and get that in writing. Don't add a "tell us about your skin concerns" box to a generic contact form just because it's easy.

Two more form rules:

  • Keep marketing consent separate and optional. On Elume's booking events, "Text me offers and last minute openings?" is its own optional tick box, separate from the email opt-in. Bundling them would undermine the consent. See our guide to SMS marketing rules.
  • Have a fallback. For treatments not bookable online, a short request form below the booking buttons catches the rest.

Whether HIPAA applies to your practice depends on how it operates. This is general information, not legal advice.

10. Show real reviews, honestly

Embed or quote your Google reviews, link to your Google profile, and ask every happy patient for a review, not just the ones you expect to be happy. Google doesn't allow businesses to "selectively solicit positive reviews" or to offer incentives for reviews (Google Maps content policy). The FTC's 2024 rule on fake reviews and testimonials also bans fake reviews, paying for reviews that must be positive, and suppressing negative ones (FTC announcement).

Don't add star-rating markup for your own business to your site. Google says a business that controls reviews about itself isn't eligible for review stars on its LocalBusiness or Organization markup, and some review widgets add that markup automatically. On Elume's site we strip it out. Our guide to getting more Google reviews covers the ask itself.

11. Add location pages only with real local content

If you draw patients from nearby towns, a page per town can help, but only if each one is genuinely different. Pages that swap the city name into the same text look like doorway pages and rarely rank.

For Elume we wrote eight city pages with real driving routes and times from each town, local context and links to two or three sibling pages. We checked them against each other: no shared prose sentence over 40 characters across all 28 page pairs. Then we requested indexing in Search Console on publish day. Requested pages were indexed within days; pages we hadn't requested sat in "Discovered, currently not indexed." Our med spa SEO guide covers city pages in depth.

12. Add structured data, and check it the right way

Structured data tells Google your business details and what you offer in a machine-readable form. At minimum, add LocalBusiness markup with your name, address, phone, hours and URL (Google's LocalBusiness guide). On Elume's site we also added MedicalProcedure markup to its 23 treatment pages, prices to treatment offers, and a single organization record listing the areas it serves.

Check it with Google's Rich Results Test or by reading the raw HTML. Many "AI SEO audit" tools fetch pages through a converter that strips JSON-LD, then report "no schema" on any site. One such tool gave us five false findings in a single report.

13. Track every step to a booked treatment

If you can't see which pages and campaigns produce bookings, you can't improve them. Set up analytics events for each step of booking, not just page views:

  1. Book button clicked or booking popup opened
  2. Booking page viewed
  3. Time selected
  4. Booking completed, with a value per treatment

On Elume's site these are GA4 events: calendly_popup_open, calendly_step_view, calendly_time_selected and calendly_booked. The booked event carries a floor value per treatment, so Google Ads can bid on value. Our Google Ads for med spas guide shows how that traced a $695 booking back to $30.41 of ad spend.

Three lessons from setting this up:

  • Tag every booking link. In one review of 25 Elume bookings, only 8 carried UTM tags, and the biggest single source carried none. Use the same lowercase source and campaign names everywhere.
  • Remove your own test bookings. Three of Elume's first six bookings were our rollout tests, and they inflated every count until we filtered them out.
  • Trust the booking system over analytics. One week GA4 recorded 4 booked events against 9 real bookings. We treat the booking tool as the source of truth and use GA4 for the path.

Where to start

If you only have an afternoon, do items 1 and 2: get a Book button and a tappable phone number onto the first screen of every page, and make sure the button opens the right service. Then build or fix your two highest-revenue treatment pages using item 3, with prices. The rest of this list is worth doing, but those three changes are where booked treatments come from.

If your site is already decent, you may not need a redesign. Most of these items are fixes, not rebuilds. Start with our 10-minute self-check and see what fails.

Frequently asked questions

How much does a med spa website cost?

It depends on the number of treatment pages, the booking integration and whether you need content written. We cover what drives the price in our guide to small business website cost. Budget for ongoing updates too, because prices and treatments change.

Should a med spa use WordPress, Wix or Squarespace?

Any of them can work. In our scan of 749 med spa sites, every major platform had both clean and problem sites. Choose the one your team can update without calling a developer, and make sure you own the domain and the account.

Do med spa websites need to be HIPAA compliant?

The website itself usually doesn't handle health records, but anything that collects health information can raise HIPAA questions, depending on how your practice is set up. The safe pattern is to keep public forms and booking questions to logistics and collect medical history in a system whose vendor signs a BAA. This is general information, not legal advice.

How many treatment pages should a med spa website have?

One for every treatment you want to be found for and booked for. If a treatment brings in real revenue, it deserves its own page with price, provider, downtime and a Book button that opens that service.