Insecure contact form
Your enquiry form collects names and phone numbers over an insecure connection.
How to see it yourself, in a minute
- Go to your contact or enquiry page.
- If the address bar says “Not secure”, or a warning appears the moment you click into a field, the form is sending what people type in the clear.
- In Chrome the warning is “Not secure” turning red when you start typing.
Or paste your address into the free audit, which checks this and seventeen other faults in ten seconds.
Why it matters
A form on an insecure page sends your customers' names, numbers and messages across the internet unencrypted. Browsers now flag the form itself, and under GDPR you are the one responsible for how that data travels.
Names, phone numbers and messages leave your visitor's browser unencrypted and can be read by anything between them and your server. Chrome and Safari now flag the form itself as you type, and most people stop. Under GDPR you are the data controller for what that form collects, so this is a compliance problem as well as a lost enquiry.
How we fix it
We move the site to a secure connection, rebuild the form so it posts securely, add spam protection, and make sure every enquiry actually arrives in your inbox.
- Secure the whole site (see “Website shows Not secure”), which is the actual fix.
- Rebuild the form to post over https, with spam protection that does not need a captcha.
- Test that submissions arrive: a surprising number of forms on old sites post into nothing.
- Add an instant acknowledgement to the sender and a copy to you, so nothing is lost when a mailbox misbehaves.
How long: A half day to a day.
This is one of the eighteen on the fix one thing list. How a fix is quoted, staged and signed off is on how it works; the site we run ourselves, with none of these faults, is on the proof page.
Who it costs most
On a site that carries stock, this fault is paid for on every item page, not just the homepage. It is one of the first things we check for:
- Websites for electrical and plumbing wholesalers · Products on your own site
- Websites for tool and industrial suppliers · Products on your own site
- Websites for salvage and used parts dealers · Parts on your own site
Questions people ask about this
- Our form goes to a third-party service, not our server. Does it still matter?
- Yes. The page the visitor types on is yours, and the browser judges the page. The data also travels from your page to the service, and it must be encrypted on that leg.
- We only collect a name and phone number.
- That is personal data under GDPR, and it is exactly what a visitor least wants read in transit. It also does not matter to the browser warning, which triggers on any form.
- How do we know if submissions have been failing?
- We test the form, then check the server logs and the mailbox it should reach. If it has been failing, we can usually tell you since when.
People usually find this page by searching
- “contact form not secure warning”
- “website form insecure chrome”
- “secure contact form”
Has your site got it?
Paste your address. This and seventeen other faults, checked in seconds.
Free, no call. The first findings come up in a few seconds and the full result in about half a minute. We load your site in a real mobile browser the way Google measures it, read your inner pages, your DNS, certificate, email records and sitemap, follow your stock list to the pages for the things you actually sell, and show you the three worst things on screen.
Or fix the lot at once
If the audit finds five or more, a rebuild is usually cheaper than five fixes. Prices are on the page.