Payment form detected over HTTP - card data transmitted unencrypted
This check looks for a payment form, one collecting card details, served over plain, unencrypted HTTP rather than secure HTTPS. On this site, a payment form was found on a page served over HTTP, meaning any card number typed into it is sent across the network in cleartext.
Why this matters
Collecting card information without HTTPS is a serious security failure: every card number entered on this page may be readable by anyone positioned on the network path between the visitor and the server. It is also likely to conflict with PCI DSS (Payment Card Industry Data Security Standard), the security standard that card networks expect of anyone handling card payments, though the exact requirements depend on how you process payments.
How to fix it
Your developer and hosting provider need to move the payment page to HTTPS immediately; this is treated as urgent, same-day work given what's being collected. If the site uses an embedded payment provider like Stripe Elements, the embed itself needs to be served on HTTPS-only pages as well. PCI DSS compliance and card network rules both require this, not just general good security practice.
Turn website findings into an action plan
Create an account to start a Full Audit of your website, with supporting evidence and a prioritised action plan.
Start Full Audit