Insecure contact form
Your enquiry form collects names and phone numbers over an insecure connection.
How to see it yourself, in a minute
- Go to your contact or enquiry page.
- If the address bar says “Not secure”, or a warning appears the moment you click into a field, the form is sending what people type in the clear.
- In Chrome the warning is “Not secure” turning red when you start typing.
Or paste your address into the free audit, which checks this and seventeen other faults in ten seconds.
Why it matters
A form on an insecure page sends your customers' names, numbers and messages across the internet unencrypted. Browsers now flag the form itself, and under GDPR you are the one responsible for how that data travels.
Names, phone numbers and messages leave your visitor's browser unencrypted and can be read by anything between them and your server. Chrome and Safari now flag the form itself as you type, and most people stop. Under GDPR you are the data controller for what that form collects, so this is a compliance problem as well as a lost enquiry.
How we fix it
We move the site to a secure connection, rebuild the form so it posts securely, add spam protection, and make sure every enquiry actually arrives in your inbox.
- Secure the whole site (see “Website shows Not secure”), which is the actual fix.
- Rebuild the form to post over https, with spam protection that does not need a captcha.
- Test that submissions arrive: a surprising number of forms on old sites post into nothing.
- Add an instant acknowledgement to the sender and a copy to you, so nothing is lost when a mailbox misbehaves.
How long: A half day to a day.
Questions people ask about this
- Our form goes to a third-party service, not our server. Does it still matter?
- Yes. The page the visitor types on is yours, and the browser judges the page. The data also travels from your page to the service, and it must be encrypted on that leg.
- We only collect a name and phone number.
- That is personal data under GDPR, and it is exactly what a visitor least wants read in transit. It also does not matter to the browser warning, which triggers on any form.
- How do we know if submissions have been failing?
- We test the form, then check the server logs and the mailbox it should reach. If it has been failing, we can usually tell you since when.
People usually find this page by searching
- “contact form not secure warning”
- “website form insecure chrome”
- “secure contact form”
Has your site got it?
Paste your address. This and seventeen other faults, checked in seconds.
Free, on screen in about ten seconds, no call. We fetch your homepage once, the way a visitor's browser does, and nothing else.
Or fix the lot at once
If the audit finds five or more, a rebuild is usually cheaper than five fixes. Prices are on the page.