Do the forms on your site send data over HTTPS?
The form destination check reads where each form on a page says it sends its data, and flags any plain http destination. No form is filled in or submitted.
What does this check look at?
It looks at whether the forms on a page say they send their data to a plain HTTP address. Lockpick never sends attack payloads, fills in your forms or tries passwords.
Pulse and Deep scans both run it.
What does a result mean?
| What the report shows | What it means | What to do |
|---|---|---|
| Pass | Every form read declares an https destination. | Nothing. |
| Attention | A form declares a plain http destination. | Point it at an https address. |
| Not tested | Forms could not be read completely, or the page builds them in the browser. | Nothing to act on. |
No form is filled in or sent, so validation, sign-in logic and cross-site request forgery defences are not tested. Scripts can change where a form really sends, so the declared destination is what the page says, not what happens on submit. A clean result means nothing was found in what the scan read. It does not prove the problem is absent from parts the scan never sees.
How serious is a finding?
Treat this as a hardening gap. It makes an attacker’s job easier but gives them no path of its own, so fix it after anything more direct. Confidence starts low, because it is inferred from headers or declarations rather than shown directly. The report lists what to fix by how directly someone could use it, not by the severity label.
What does a confirmed finding have to show?
| Part | For this check |
|---|---|
| Where it starts | Someone on the visitor's network |
| The protection that should stop it | The page loads content or sends forms without HTTPS |
| What is reached | Content or form data in transit |
| What follows | A hardening gap; no interception was attempted |
Which standards does it relate to?
| Standard | Reference |
|---|---|
| OWASP Top Ten | A04:2025 Cryptographic Failures |
| CWE | CWE-319 |
| ASVS | v5.0.0-12.2.1 |
Each one is a related control, not a verification. A scan sees what anyone online can see, so it never proves a whole requirement is met.
Fix it with your AI
Ask your AI to check the declared destination and the code that really submits the form.
Find every form on my site and check where it submits: the action attribute and any JavaScript submit handler. Make sure each one posts to an https:// address on my own site or my form provider. Change any http:// destination to https://, and tell me if a form sends data to another company I did not expect.How to check
Say Atlas, our example app at atlas.example, has a newsletter form whose action still points at an old http address. The check flags it, and changing the address to https fixes it.
The free quick check covers this on your homepage with no account, and a Pulse scan from your account adds your scripts and public records. Pulse or Deep explains the difference.
Questions people ask
Does this check my login form for other problems?
No. It only reads the declared destination. Password-specific problems, such as a password sent in the address, have their own check.
Why is it marked not tested on my React app?
If forms only exist after scripts run, the HTML the scan read may not contain them. The report says so rather than guessing.
See what your site shows from outside
A quick check reads your homepage the way a visitor would and gives you a score. No account needed.
Check your siteSources
- How we rate findings Lockpick docs, read on October 7, 2026
- What we never do Lockpick docs, read on October 7, 2026