Payment form detected over HTTP - card data transmitted unencrypted

This check looks for a payment form, one collecting card details, served over plain, unencrypted HTTP rather than secure HTTPS. On this site, a payment form was found on a page served over HTTP, meaning any card number typed into it is sent across the network in cleartext. Collecting card information without HTTPS violates PCI DSS (Payment Card Industry Data Security Standard), the security standard that card networks require of anyone processing payments. Every card number entered on this page is readable by anyone positioned on the network path between the visitor and the server, and this is both a security failure and a compliance violation, not just a best-practice gap. Your developer and hosting provider need to move the payment page to HTTPS immediately; this is treated as urgent, same-day work given what's being collected. If the site uses an embedded payment provider like Stripe Elements, the embed itself needs to be served on HTTPS-only pages as well. PCI DSS compliance and card network rules both require this, not just general good security practice.