Insecure Form Scanner
Detects password forms served over HTTP or submitting credentials to an unencrypted URL.
What it checks
This scanner detects password forms served over HTTP or submitting credentials to an unencrypted URL. It identifies forms where the data the user types travels without protection.
Why it matters
When a login form travels unencrypted, anyone on the same network can intercept the username and password being typed. This directly exposes your users' accounts to credential theft.
How to fix it
Make sure every page with forms is served over HTTPS and that the form's destination (the action attribute) also points to an HTTPS URL. Serving the whole site under HTTPS and forcing the redirect is the simplest way to cover this.
Check it on your site
Scan your site free and see if this and 44 other checks pass, with a fix prompt for every issue.
Scan my site free