# staticformspamshieldkit report: https://demo-studio.example/contact

> Demo report on a fictional sample site.

**Score:** 31/100 · Scanned 2026-10-27T03:14:15.636Z

5 of 7 checks need attention (2 high priority).

- [x] **Lead or contact form found** (medium): 1 form(s): POST http://demo-studio.example/contact.php
- [ ] **Honeypot or CAPTCHA on every form** (high): Unprotected: http://demo-studio.example/contact.php
- [ ] **Forms post over HTTPS** (high): Insecure action: http://demo-studio.example/contact.php
- [x] **Forms use POST** (medium): All POST.
- [ ] **CSRF token or third-party form backend** (low): 0/1 carry a token.
- [ ] **Email field uses type="email" and autocomplete** (low): 1/1 email fields typed; 0 with autocomplete.
- [ ] **No exposed mailto: addresses** (low): 2 mailto link(s) (demo-studio.example) that scrapers harvest.

---
Passive: one request for the page; forms are read from the HTML and never submitted. Forms rendered only by JavaScript may not be visible.