Security & HTTPS
Forms on secure pages send their contents over plain HTTP
One of the 136 checks Lala SEO runs on every page of a site in a free audit.
- How serious
- Worth fixing. Weakens how Google reads or shows the page. Fix after the serious ones.
- Score
- Reported, but it does not lower your site's score.
- Based on
- Industry standard: Google does not document this one, so the check follows established practice.
What is wrong
When a visitor fills in a form on a page you've secured with HTTPS (the padlock icon), their answers—passwords, addresses, payment details—must travel back to your server over HTTPS as well. If the form is set to post its data over plain HTTP instead, it leaves a window where someone on the same network could intercept what they typed.
Why it costs you
The risk is that sensitive information gets stolen before it reaches you. Passwords, credit card numbers and personal data sent over unencrypted connections are readable to anyone monitoring the network traffic, whether that is someone on their home WiFi or a malicious actor on a public network.
How to fix it
Find each form on your secure pages and check its `action` attribute in the HTML. It should start with `https://`, not `http://`. If you use a form template that many pages share, edit the template file once rather than each page individually. Change the form action URL to use `https://` and test by submitting the form yourself to confirm the data travels securely.
What the audit tests
- No form on a secure (HTTPS) page sends what is typed in to an http:// address
- No submit button on a secure page redirects its form to an http:// address
Check your site
Run a free audit of up to 300 pages. No card needed.
Start a free auditOr check a single address with the free tool.