Skip to content
Raptor home
Menu

Form on an HTTP page

security.form_on_http
Priority
High
Severity
Warning

What we look for

These pages are served from an http:// address and hold a form whose action (the address it sends what visitors type to) also starts with http://.

Why it matters

Both the form and what visitors type into it travel unencrypted, and browsers mark the page Not secure.

How to fix

Move these pages to https:// with an SSL certificate, send each http:// address to its https:// version with a 301 redirect (a permanent forwarding rule), and change the form's action to https://.

Where you’ll see it

The id is stable, and every surface uses it, so it’s the thing to search for or hand to an agent.

Terminal
When it is one of the five findings under Fix first, raptor crawl prints the id under it.
Check: security.form_on_http
crawl.json and the CSV
The crawl JSON names the finding by this id, and so do the CSV and raptor_query.
"check_id": "security.form_on_http"
The HTML report
This link opens the finding in the report, and each finding shows its id.
crawl.html#finding=security.form_on_http
MCP
raptor_findings with this check_id returns the finding in full, with a fix brief ready to paste into a task. If it didn’t fire, it says why.
raptor_findings {
  "job_id": "...",
  "check_id": "security.form_on_http"
}