A credential in an href leaks into browser history, server logs, and the Referer header sent to the destination site. It is exposed the moment the page is rendered, not the moment the link is clicked.
- Free, no signupNo account, no card
- No AI in the score986 deterministic rules
- Nothing publishedYour scans stay yours
- Answers in secondsQuick scan, no browser
How this rule is weighted
- Importance
- 9 / 10
- How much this matters relative to other rules.
- Confidence
- RESEARCH
- Backed by large-sample study or industry research, not a specification.
- Severity
- critical
- How the finding is presented when it fails.
- Scoring
- Counts
- A failure costs points in its category.
Impact is importance multiplied by the confidence tier’s weight — SPECIFICATION 1.0, RESEARCH 0.7, EMERGING 0.3, EXPERIMENTAL 0.1. Two rules backed by the same class of evidence therefore always carry the same weight, which is what makes the score reproducible rather than hand-tuned.
Questions about this rule
- Does TRUST_NO_CREDENTIAL_IN_URL affect my score?
- Yes. It is an importance 9 rule at RESEARCH confidence, so a failure costs 9 × 0.7 points of impact in the Trust & Scam category before that category is normalised to 100.
- What does RESEARCH confidence mean?
- Backed by large-sample study or industry research, not a specification. Confidence is a declared tier rather than a per-rule number, so every rule backed by the same class of evidence carries the same weight - which is what makes the score reproducible instead of hand-tuned.
- How do I check TRUST_NO_CREDENTIAL_IN_URL on my own site?
- Paste your URL into the box above and it runs only this rule, usually in a couple of seconds. It is also included in the Trust & Scam checker and in a full scan.
Tags
- trust
- security
- secrets
Related Trust & Scam rules
- Sensitive forms are not submitted insecurelyCredentials or card details posted over plain HTTP can be read in transit. That is a direct PCI-DSS and data-protection failure, not a best-practice note.TRUST_SECURE_PAYMENT_CONTEXT
- No direct executable downloadsDirect executable download links are a hallmark of malware distribution and will trigger Safe Browsing warnings.TRUST_NO_AUTO_DOWNLOAD
- Passwords are never submitted in a URLA GET form puts the password in the query string, where it lands in browser history, server access logs, proxy logs and the Referer header sent to every third party on the next page.TRUST_NO_PASSWORD_OVER_GET
- A contact route is reachableA site with no way to reach a human is the most frequently cited reason people judge a site untrustworthy, and it blocks most payment-processor reviews.TRUST_CONTACT_METHOD
- Forms submit over HTTPSA form posting to http:// sends whatever the user typed in cleartext, and browsers now block or warn on it. The padlock on the page says nothing about where the form data goes.TRUST_FORM_ACTION_HTTPS
- No obfuscated link destinationsA link whose destination cannot be read before clicking is a standard phishing pattern and is treated as such by browsers.TRUST_NO_OBFUSCATED_LINKS