Matan · Security · Content
Forms over HTTPS (Security)
Form action URLs must not post to http://.
Pass condition in our engine: No form action starts with http://.
This Security check is part of SEO-GEO scoring 2.2.1, last updated 2026-09-18. About 90 percent of the evaluation runs on the HTML we crawl, so you can verify the same pass condition with a free report.
1. Problem description
A login or checkout form that posts to HTTP sends secrets in cleartext even if the page itself is HTTPS. We look at action attributes starting with http://.
2. Most common causes
- Absolute http:// action copied from an old environment.
- A payment vendor still on HTTP (replace them).
3. How to fix it
- Use https:// or relative actions.
- HSTS plus mixed-content fixes as backup.
Test this check
We fetch only this URL (plus robots.txt / llms.txt at the domain root when the check needs them). We do not crawl the rest of the site like a full report.
Scoring rules for the full site crawl are documented in methodology. Want every category at once? Generate a free report.
Get your free website audit
Enter your URL and receive a full audit with scoring and recommendations. No sign-up required.