Forms submitted over plain HTTP
Effort to fix: Moderate (a few hours)
Why it matters
Anything typed into these forms, such as emails, messages or passwords, travels across the internet readable by anyone on the path.
How to fix it
Serve the site over HTTPS (see the HTTPS finding) and make sure every form's action URL uses https://.
On WordPress
After moving to HTTPS, check contact-form and newsletter plugin settings for hard-coded http:// endpoints.