Insecure Form Submission
A form that posts over plain HTTP, sends a password via GET, or sits on an unencrypted page hands user credentials to anyone on the network path.
Why It Matters
Credentials submitted over HTTP are readable by every hop between the user and your server — public Wi-Fi, hotel networks, compromised routers. A password sent with GET is worse still: it lands in the URL, the browser history, proxy logs and the `Referer` header of every subsequent request.
How We Check
We parse every `<form>` on the page and flag `action` attributes on `http://`, password fields submitted with `method="get"`, password or credential fields served on an HTTP page, and credential fields sent via GET.
How to Fix
Serve the whole page over HTTPS and point every form action at an https:// URL or a relative path. Use method="post" for anything carrying credentials. Redirect HTTP to HTTPS and add HSTS so the insecure version is never reached in the first place.
Frequently Asked Questions
What is Insecure Form Submission?
A form that posts over plain HTTP, sends a password via GET, or sits on an unencrypted page hands user credentials to anyone on the network path.
Why does Insecure Form Submission matter for website security?
Credentials submitted over HTTP are readable by every hop between the user and your server — public Wi-Fi, hotel networks, compromised routers. A password sent with GET is worse still: it lands in the URL, the browser history, proxy logs and the `Referer` header of every subsequent request.
How do I fix Insecure Form Submission issues?
Serve the whole page over HTTPS and point every form action at an https:// URL or a relative path. Use method="post" for anything carrying credentials. Redirect HTTP to HTTPS and add HSTS so the insecure version is never reached in the first place.
Related Security Checks
Check Your Website Now
Run a free security scan to check for Insecure Form Submission issues and 62+ other security vulnerabilities.
Scan Your Website Free