A form collecting personal data submits via GET
A form on this page uses method=GET and collects personal data (for example an email address).
Why it matters
A form on this page uses method=GET and collects personal data (for example an email address). Submitting via GET places that value in the URL, where it is recorded in server logs, browser history, and any Referer header sent to third parties. Personal data should be submitted with method=POST so it stays out of the URL. (The specific field is named in this finding's evidence.)
How ShipReady detects it
Per-page privacy signals read straight from the fetched HTML and response headers — no extra requests. Page-scoped because trackers, cookies and forms genuinely differ between routes (a marketing homepage vs a bare /login), and the route that carries the signup form is exactly the one worth seeing.
Detection is deterministic. ShipReady reports this only when it observes the condition directly, and prefers to miss a real problem over inventing one. Rule version 1.0.0.
How to fix it
This is the prompt ShipReady puts in your report — written to be pasted straight into Cursor, Claude Code, or whichever assistant built the app.
A form on this page uses method=GET and collects a personal-data field (such as an email address). GET puts the submitted values in the URL, where they are stored in server access logs, the visitor's browser history, and the Referer header sent to any third party the next page links to. Change the form to method="POST" (and update the handler/route to read the body instead of the query string) so personal data is sent in the request body rather than the URL.
Frequently asked questions
- What does "A form collecting personal data submits via GET" mean?
- A form on this page uses method=GET and collects personal data (for example an email address).
- How serious is it?
- ShipReady rates this medium. Fix soon. Meaningfully weakens a defence or degrades how the site works.
- How do I fix it?
- Paste the fix prompt on this page into Cursor, Claude Code or your AI editor. It is the same prompt ShipReady puts in your report.
- Can I check my own site?
- Yes — ShipReady scans up to ten pages of any public site for free and reports this alongside every other check. The free report lists every issue it finds and shows full evidence and a fix prompt for the critical and high-severity ones; medium and low findings are counted and unlock on Pro.
Related checks
- A device-fingerprinting script is presentmedium
- Session-replay or behaviour-recording script is presentmedium
- Tracking cookie is set before the consent banner can be answeredmedium
- Tracking cookie is set on the first responsemedium
- Analytics or advertising tracker loads without a detected consent steplow
- Fonts are loaded from Google's serverslow
Run this check on your site
ShipReady checks this and 193 other things across up to ten pages of your site, with an AI-ready fix for each. Free, no signup.