Invicti detected that a critical form's action is targetted an HTTP resource.

If an attacker can intercept network traffic, he/she can steal users' credentials. In this case even though the form is served over HTTPS, it'll be submitted to an HTTP resource. This defeats the purpose of SSL protection for this form.

All sensitive data should be transferred over HTTPS rather than HTTP. Forms should be served over and form actions also should target HTTPS. All aspects of the application that accept user input, starting from the login process, should only be served over HTTPS.

1. See the remedy for solution.
2. Move all of your critical forms to HTTPS and ensure their form actions are targetting HTTPS.