A sign-in form sends passwords over an unencrypted connection
A form on this page collects a password and posts it to the address it names — an explicit `http://` address, so the submission travels unencrypted no matter how the visitor reached the page.
Why it matters
A form on this page collects a password and posts it to the address it names — an explicit `http://` address, so the submission travels unencrypted no matter how the visitor reached the page. The padlock in the address bar does not protect it: the browser will happily load a secure page and then send the form contents in the clear. Anyone on the path — a shared Wi-Fi network, a compromised router, an ISP — can read every password submitted here, and can alter the response to change what the form does next. Because people reuse passwords, a single intercepted credential is often usable on that person's email and bank as well, which makes this worse than it looks from inside your own product. Point the form's action at the https:// address of the same endpoint, and confirm that endpoint really serves https rather than redirecting — a redirect happens only AFTER the password has already been sent once.
How ShipReady detects it
How a form carrying a password submits it. PAGE-scoped, because a sign-in form lives on one route and the crawl reaches it separately from the homepage. Every finding's merge_key is the submission endpoint, so one login form reachable from ten pages is one finding.
Detection is deterministic. ShipReady reports this only when it observes the condition directly, and prefers to miss a real problem over inventing one. Rule version 1.0.0.
How to fix it
This is the prompt ShipReady puts in your report — written to be pasted straight into Cursor, Claude Code, or whichever assistant built the app.
A form that collects a password posts it to an `http://` address, so every password typed into it crosses the network in clear text. Fix the form, then treat the passwords that already went through it as compromised. CHANGE THE ACTION TO https://, pointing at the same endpoint. Do not rely on the server redirecting http to https for this: a redirect arrives AFTER the browser has already sent the password once, so the credential is exposed before the redirect can help. Confirm the https endpoint serves the route directly. CHECK FOR THE SAME MISTAKE ELSEWHERE. Grep the codebase for `action="http://` and `http://` in fetch/axios calls — a hardcoded http:// endpoint is usually copied between templates, so where there is one there are often several. In React and other frameworks the form may have no action at all and submit through JavaScript instead; check the URL that code posts to as well. STOP IT COMING BACK. Serve `Strict-Transport-Security` with a long max-age so browsers refuse plain http to your domain outright, and add a `Content-Security-Policy: upgrade-insecure-requests` header so any http:// subresource or form target is rewritten to https before it is used. THEN HANDLE THE EXPOSURE. Anyone on the network path could have captured these passwords, and people reuse them across sites. Force a password reset for accounts that signed in through this form, and say so plainly when you do.
Frequently asked questions
- What does "A sign-in form sends passwords over an unencrypted connection" mean?
- A form on this page collects a password and posts it to the address it names — an explicit `http://` address, so the submission travels unencrypted no matter how the visitor reached the page.
- How serious is it?
- ShipReady rates this high. Fix before launch. A real weakness that an attacker can act on.
- How do I fix it?
- Paste the fix prompt on this page into Cursor, Claude Code or your AI editor. It is the same prompt ShipReady puts in your report.
- Can I check my own site?
- Yes — ShipReady scans up to ten pages of any public site for free and reports this alongside every other check. The free report lists every issue it finds and shows full evidence and a fix prompt for the critical and high-severity ones; medium and low findings are counted and unlock on Pro.
Related checks
Run this check on your site
ShipReady checks this and 193 other things across up to ten pages of your site, with an AI-ready fix for each. Free, no signup.