Forms
Labels, names and submit controls of forms.
A form sends data to another domain
Section titled “A form sends data to another domain”form.action.external · Review signal (Needs review) · Severity: Medium
Why it matters. Sending form data to another domain introduces an external processor and a dependency that must be trusted, available and documented.
How to fix. Confirm that the external destination is intentional, secure and covered by the relevant privacy documentation.
A form sends data over HTTP
Section titled “A form sends data over HTTP”form.action.insecure · Issue · Severity: High
Why it matters. Submitting form data over an insecure connection can expose personal or sensitive information in transit.
How to fix. Use an HTTPS form endpoint to protect submitted data and avoid mixed-content blocking.
A form may need a consent notice
Section titled “A form may need a consent notice”form.consent.review_missing · Review signal (Needs review) · Severity: Set per finding
Why it matters. A form collecting personal data without an evident consent or legal basis review can create privacy and compliance risk.
How to fix. Confirm GDPR and marketing-consent requirements for the form’s target markets before launch.
A form has an inline submit handler
Section titled “A form has an inline submit handler”form.custom_script.detected · Review signal (Needs review) · Severity: Set per finding
Why it matters. Custom form scripts can override native browser behavior and introduce dependencies that structural checks cannot fully validate.
How to fix. Review the script endpoint, consent behavior, error handling, duplicate-submission protection and data destination manually.
A form sends data to a custom address
Section titled “A form sends data to a custom address”form.destination.custom_action · Review signal (Needs review) · Severity: Set per finding
Why it matters. A custom submission destination moves data outside the page’s standard handling and needs review for reliability, privacy and expected processing.
How to fix. Confirm the endpoint, method, field mapping, privacy basis, error handling and receipt manually.
A personal-data form field may be missing autocomplete
Section titled “A personal-data form field may be missing autocomplete”form.field.autocomplete_missing · Review signal (Needs review) · Severity: Low
Why it matters. Missing autocomplete tokens make forms slower and harder to complete, particularly for users with motor or cognitive disabilities.
How to fix. Add an appropriate autocomplete token such as email, tel, given-name or family-name where applicable.
A submitted form field has no name
Section titled “A submitted form field has no name”form.field.name_missing · Issue · Severity: Medium
Why it matters. A control without a name can be omitted from the successful form payload or arrive without a stable key, so webhooks and custom integrations cannot reliably map its value.
How to fix. For every listed form control, add a stable name key that describes the value (for example, email or message), then verify that the receiving integration maps that key.
A form field uses an invalid input type
Section titled “A form field uses an invalid input type”form.field.type_invalid · Issue · Severity: Medium
Why it matters. An invalid field type can disable browser validation, mobile keyboard optimization or reliable form behavior.
How to fix. Use a valid HTML input type and verify validation and keyboard behavior.
A form field group has no legend
Section titled “A form field group has no legend”form.fieldset.legend_missing · Review signal (Needs review) · Severity: Medium
Why it matters. Related form controls without a group label can lose the context users need to understand what each option means.
How to fix. Add a concise legend as the first child of each fieldset, especially for grouped controls.
A form contains another form
Section titled “A form contains another form”form.nested.invalid · Issue · Severity: High
Why it matters. Nested forms are invalid HTML and can cause browsers to submit the wrong fields or ignore expected form boundaries.
How to fix. Remove the nested form and keep each control inside exactly one form element.
A form has no privacy link
Section titled “A form has no privacy link”form.privacy_link.missing · Review signal (Needs review) · Severity: Set per finding
Why it matters. Users may submit personal information without an accessible explanation of how the data will be processed.
How to fix. Add a privacy or legal link near the form when it collects personal data.
A form’s success page returns an error
Section titled “A form’s success page returns an error”form.redirect.unreachable · Issue · Severity: Medium
Why it matters. Only the declared target availability was tested; the form was not submitted and the real success flow remains unverified.
How to fix. Review the captured evidence and its measurement scope, then verify the intended behavior.
A form’s submission was not tested
Section titled “A form’s submission was not tested”form.submission.manual_review · Review signal (Needs review) · Severity: Set per finding
Why it matters. Structure alone cannot prove that a form submits, validates and reaches its intended destination, so a launch-critical user journey remains unverified.
How to fix. Submit the form manually with safe test data and verify validation, success/error states, delivery and integrations.
The form has no detected submit control
Section titled “The form has no detected submit control”form.submit.missing · Issue · Severity: High
Why it matters. Without a usable submit control, visitors may be unable to complete the form at all.
How to fix. Confirm that the form can be submitted and has clear success and error states.