Fix forms that submit over plain HTTP

15 min Impact: high Effort: low ✓ Scan-verified — no manual checkbox

A form on an HTTPS page that submits its data to a plain HTTP endpoint sends everything the visitor typed — including passwords or payment details — over an unencrypted connection, even though the page itself looked secure with a padlock icon.

A form whose action posts to http:// instead of https:// sends whatever the visitor typed — including passwords — across the network in plain text, readable by anyone on the same network.

How to fix it

1

Check every form's action attribute

Look at each <form> tag's action URL — confirm it starts with https://, not http://.
2

Fix any found

Update the form action to point to the https:// version of the same endpoint.
3

Check forms that submit to third-party services too

Newsletter signups, payment forms, and embedded widgets sometimes submit to an external service — confirm that endpoint is also HTTPS.

Common mistakes

Modern browsers show an explicit warning when a form on an HTTPS page submits to HTTP — if you're not seeing that warning yourself, it's worth checking anyway since some browsers only warn on password fields specifically.

How you'll know it's done

Every form on the site submits its data to an HTTPS endpoint.

H.I.V.E. checks this automatically

Fix it, then re-scan — the check confirms itself. No manual checkbox, the scan is the truth.

Run this check in H.I.V.E. →

Fix forms that submit over plain HTTP

How to fix it

Common mistakes

How you'll know it's done

Related checks

H.I.V.E. checks this automatically