Insecure Form Actions Check
Detect forms that submit user-entered data to an insecure HTTP destination.
Check your websiteWhy this check matters
An insecure form action can expose personal information, credentials, or lead data in transit even when the visible page itself uses HTTPS.
Passing evidence
<form action="https://example.com/contact" method="post">Common failing evidence
<form action="http://example.com/contact" method="post">Possible false positives
- A form without an action submits to the current page and inherits its transport.
- Development-only endpoints should not appear in production HTML.
How to fix it safely
- Change every production form endpoint to HTTPS.
- Update third-party form integrations or replace insecure providers.
- Avoid constructing action URLs from untrusted client values.
How to verify the fix
- Inspect each rendered form action.
- Submit test data and confirm the final request remains HTTPS through redirects.
Related Security checks
Run the complete audit
Check this signal together with the related category evidence on the current public page.
Open the security audit tool
