URL: /rules/security/form-https --- title: "Form action over HTTP: the insecure form submission warning" description: "A form on an HTTPS page that posts to http:// sends the data in the clear and browsers interstitial it. squirrel checks action and formaction." --- ## What an insecure form action is A form's `action` attribute is the URL the browser submits to. When that URL is `http://`, the field values travel unencrypted regardless of how the page itself was delivered. The padlock in the address bar describes the document, not the submission. The worst version is an HTTPS page with an HTTP action, because the user has every visual signal that the page is safe. Chrome and Firefox warn on it and may block the submission. A relative action such as `/subscribe` resolves against the document base URL, which is the page URL unless a `` overrides it, so it is safe on an HTTPS page with no HTTP base. Only actions that carry their own scheme are checked. `formaction` on a submit button overrides the form's action and needs the same treatment. ## What squirrel checks The rule runs on every crawled page and emits a single check named `form-https`. It collects every `
` plus every `formaction` on a real submit control, meaning `button[formaction]` that is not `type="button"` or `type="reset"`, `input[type="submit"][formaction]` and `input[type="image"][formaction]`: - Fail when the page is HTTPS and at least one of those actions resolves to `http:`. Message: `2 form(s) on this HTTPS page submit to HTTP`, and each item is labelled `HTTPS page submits to in the clear`. Severity error. - Warn when the page is not HTTPS and an action still resolves to `http:`. Message: `2 form(s) submit to HTTP`. - Pass when at least one `action` or qualifying `formaction` was collected and none of them submit over HTTP. Message: `All forms use secure submission`. - Info when the page carries no `action` or `formaction` at all, even if it has `` elements. Message: `No forms detected`. Empty actions, fragment-only actions and the non-network schemes `javascript:`, `mailto:`, `tel:`, `sms:`, `data:`, `blob:` and `about:` are skipped. So are relative actions, because their scheme comes from the page and `security/https` already reports that. An action that fails to parse is still flagged when it literally begins with `http://`. ## How to fix it ```html ``` Change the scheme at the source, or drop the origin entirely and use a relative action, which is safe as long as the document base URL is HTTPS. Check `formaction` on any submit button that overrides the form, since it is easy to miss in a template. | | | |---|---| | **Rule ID** | `security/form-https` | | **Category** | [Security](/rules/security) | | **Scope** | Per-page | | **Severity** | error | | **Weight** | 6/10 | ## Enable / disable ### Disable this rule ```toml squirrel.toml [rules] disable = ["security/form-https"] ``` ### Disable all Security rules ```toml squirrel.toml [rules] disable = ["security/*"] ``` ### Enable only this rule ```toml squirrel.toml [rules] enable = ["security/form-https"] disable = ["*"] ``` ## Related rules - [security/form-captcha](/rules/security/form-captcha): the same forms, checked for bot protection. - [security/https](/rules/security/https): the page scheme that a relative action inherits. - [security/mixed-content](/rules/security/mixed-content): subresources with the same downgrade problem. - [a11y/form-labels](/rules/a11y/form-labels): the accessibility pass over the same markup. Security findings ship in every audit next to the SEO, performance and agent experience rules. See [Website security scan with AI](https://squirrelscan.com/learn/audit-website-security-with-ai) for how an agent works through a report. ## References - [The form element, MDN](https://developer.mozilla.org/en-US/docs/Web/HTML/Reference/Elements/form) - [Mixed content, MDN](https://developer.mozilla.org/en-US/docs/Web/Security/Mixed_content) ## Check your site Run `squirrel audit https://example.com` and open the Security section of the report. Every insecure form action is listed by page with the form's selector and a markup snippet. Local audits are free. One command to install, one to run your first audit. What the Security section looks like on a real site.