Is your contact form sending customer data in the clear?

Contact forms feel harmless, so nobody looks at them after launch. But a form collects names, phone numbers, addresses and sometimes far more, and all of it has to travel somewhere and be stored somewhere.

What we found on local sites

• A Grand Strand business whose site has no working secure connection: its certificate is expired, so browsers warn visitors away, and its form sends what people type over plain, unencrypted http.
• A car dealer whose site takes credit applications, including Social Security numbers, with no privacy policy on the site saying what happens to them.

Check yours in two minutes

1. Look for the lockOpen the page with your form. The address should start with https and show a lock. If the browser warns you instead, the form isn’t safe to use. Our free website check reports this too.
2. Look at what it asks forA contact form needs a name, a way to reply and a message. If it asks for a Social Security number, date of birth, card number or health details, it needs to be a proper secure application, not a plain form.
3. Find out where the entries goSubmit a test entry and follow it: which inbox, which plugin, which outside service. Then ask how long it’s kept and who can see it.
4. Read your privacy policyIf the form collects personal information, the site should say what you do with it. A template policy that names a different business, or no policy at all, is worse than it looks.

What a safe form looks like

• The whole site on HTTPS, with browsers told to never use the insecure version.
• Only the fields you actually need. Every extra field is something you’re now responsible for.
• Sensitive applications, credit, medical, legal, handled in a secure portal or by a service built for it, not a form that emails a PDF.
• Notification emails that say a new entry arrived, with a link to sign in and read it, instead of the full contents.
• Old entries deleted on a schedule, and spam protection that doesn’t make real customers solve puzzles.