Credibility · 22 points
Form transport
One check, stated three ways: what we measure, what would make it wrong, and how to confirm it yourself.
What this measures
Whether any <form action> on an HTTPS page points at an http:// endpoint.
Where this check can be wrong
A form posting to http on a same-host page that already redirects to https is cosmetic, and we cannot see a JavaScript override of the action attribute.
Verify it without taking our word for it
curl -s https://your.site | grep -io '<form[^>]*' — then check each action= value.