Unsafe forms checker

What the unsafe forms checker does

This tool scans an HTTPS webpage for forms and identifies those whose action points to an insecure HTTP URL. It reports the forms that would send user input over plain HTTP, which undermines the security of the page.

A form's action attribute defines where the submitted data is sent. If an HTTPS page contains a form that submits to http://, the data travels unencrypted after the user presses submit. That can expose sensitive information to interception.

Why unsafe forms matter

Users trust HTTPS pages with personal data. If the form posts to an insecure endpoint, that trust is misplaced. Attackers on the same network can potentially read or modify the submitted data, including credentials, contact details, or payment information.

Browsers increasingly warn about insecure form submissions and mixed content. Beyond security, an insecure action can trigger warnings that damage credibility and cause users to abandon the form. It can also affect how the page is treated by security-conscious tools and audits.

How to interpret the result

The tool reports the unsafe forms it found. Each one points to an HTTP URL rather than HTTPS. Verify the finding in the page source by checking the form's action attribute. If the action is relative, it inherits the page's protocol and is usually secure on an HTTPS page; the concern is an explicit http:// destination.

Some forms may be intentionally external, such as a third-party service that only supports HTTP. That does not make the submission safe; it means the integration needs review. In most cases, the correct fix is to change the action to an HTTPS endpoint, ideally on the same site.

Common causes

• Hardcoded HTTP URLs. Legacy templates that predate the HTTPS migration.
• Third-party integrations. External form handlers that use insecure endpoints.
• Mixed content in scripts. JavaScript building a submission URL with http://.
• Stale configuration. Settings that were not updated after enabling HTTPS.

Practical workflow

Review the reported forms and confirm each action in the source. Update internal endpoints to HTTPS. For third-party handlers, check whether a secure endpoint is available and migrate. After changes, test the form end to end and re-run the check to confirm the fix.

Limitations

The checker examines form elements present in the HTML response. Forms created or modified by client-side scripts may not be detected, and a secure action URL does not guarantee the destination server is properly configured.