A form collecting passwords or payment details submits over plain HTTP

This check looks at where a form's data is actually sent when submitted, called its 'action' address, for any form collecting a password or payment details. On this site, such a form was found submitting to an http:// address rather than a secure https:// one, meaning the sensitive data typed into it travels across the network unencrypted. Even on a page that itself uses HTTPS, a form pointing at an http:// address sends whatever was typed into it, potentially a password or payment details, in clear text that anyone on the same network path can read. It also triggers a 'Not secure' browser warning right at the moment of submission, which understandably destroys trust and stops people completing the form. Your developer should change the form's action address from http:// to https://, and confirm the receiving endpoint actually supports a secure connection. This is usually a one-line code change, but should be treated as urgent given what's being collected, and tested by submitting the form and checking there's no browser security warning.