webzod
account

Make forms submit over HTTPS on WordPress

headers.resources.insecure_form · effort: minutes

Why it matters

A form that posts to an http:// address sends whatever visitors type, such as passwords or contact details, unencrypted. Browsers also warn visitors before submitting it.

The fix

  1. Set WordPress Address and Site Address to https:// and replace old http links with wp search-replace (see the mixed content fix); forms that post to your own site then use https.
  2. For forms from a newsletter or CRM service pasted into a widget or page, paste the provider's current embed code, which uses https. Check form plugin settings for hard-coded http:// action URLs.

Read the documentation (opens in a new tab)

Related

Scan your domain to see whether this applies to you.