Skip to content
Formward
EN
Start free

Free tool

Check your website forms for privacy and GDPR risks

Paste a page's HTML to check its forms for common technical privacy issues, third-party destinations, insecure submission settings and missing disclosures. You get findings with the evidence behind them and what to do, without creating an account.

This tool performs automated technical checks. It does not determine whether a website complies with GDPR and is not legal advice.

Paste the whole page source or just the form. It is checked in your browser and never sent to us.

Lets the check resolve relative form actions and tell whether the form submits to another domain.

Checking by address is not available right now. Open the page, view its source (Ctrl+U or Cmd+Option+U) and paste the HTML here.

How the check works

The checker parses the HTML of the page with an HTML parser. It never runs the page's scripts, never submits the form and never loads the third-party resources it lists. Every finding names the markup it is based on, says how sure the check is, and whether the finding was seen directly or inferred from field names and text.

Findings are sorted into five groups: critical technical issues, potential privacy concerns, information, things a page check cannot determine, and checks that passed. There is no overall score, because a score would suggest a legal verdict that HTML cannot support.

What it looks at

  • Transport: whether the page and the form's action use HTTPS, and whether a secure page submits to an insecure address.
  • Method: whether personal data would travel in the URL because the form uses GET (or no method, which defaults to GET).
  • Recipient: whether the form submits to another domain, and whether that domain belongs to a known form service.
  • Third parties on the page: analytics, advertising, tag manager, chat and anti-bot scripts, and embedded forms from other services.
  • Fields: names, emails, phone numbers, addresses, messages, file uploads, hidden tracking identifiers and fields that may hold special-category data.
  • Privacy information: a link to a privacy notice in or next to the form, pre-ticked consent boxes and marketing consent made mandatory.

What it cannot tell you

Most of a form's GDPR position lives outside its HTML. An automated check cannot establish:

  • the lawful basis for each purpose;
  • whether a data processing agreement is in place;
  • where submissions are actually stored, or every international transfer;
  • how long the backend keeps submissions;
  • whether a third-party script actually sends personal data;
  • how well the receiving server is secured;
  • whether the site as a whole complies with the GDPR.

A domain ending in .eu, or a company address in Europe, does not show where data is stored. Check the provider's sub-processor list and data processing agreement.

What happens to what you enter

Pasted HTML is checked inside your browser and is never sent to Formward. When you check an address, our server in Sweden fetches that one public page over HTTPS, follows at most three redirects to other public addresses, reads at most 512 KB and returns the result to your browser. We do not store or log the address, the page or the result. To prevent abuse, checks are counted per visitor against a keyed hash of the IP address (never the address itself), and those counters are deleted within two days.

Questions

Does a form need a consent checkbox under the GDPR?
Not always. Consent is one of six lawful bases. Answering a message someone sends you usually rests on steps before a contract or on legitimate interest, and then a checkbox adds nothing. You need an unticked, optional checkbox for purposes that do rely on consent, such as signing up to a newsletter.
Why does the checker not give a compliance score?
Because the HTML of a page cannot show the lawful basis, the contracts, where data is stored or how long it is kept. A score would suggest a verdict the check cannot support, so it reports evidence instead.
Does an analytics script on the page mean form data is sent to that company?
Not by itself. Scripts on the same page can read what is typed into it, and some tools record sessions or forms when configured to. The checker lists them so you can check their settings and consent, not as proof of a transfer.
My form is built with JavaScript and the checker finds nothing. Why?
The checker reads the HTML your server sends and does not run scripts. Open the page in your browser, inspect the form element, copy its HTML and paste it into the checker.

Related