SecurityMetrics PCI scan keeps failing... NEED HELP!

[bosrob]

http://best-organic-supplements.com/store

SecurityMetrics

Synopsis : The remote web server might transmit credentials in cleartext. Description : The remote web server contains several HTML form fields containing an input of type 'password' which transmit their information to a remote web server in cleartext. An attacker eavesdropping the traffic between web browser and server may obtain logins and passwords of valid users. Solution: Make sure that every sensitive form transmits content over HTTPS.

---

Our customer form fields are all on secure pages and transmitted over HTTPS. The only form not secure is our contact us form. To my knowledge the contact us form does not need to be transmitted over HTTPS Or maybe it does i don't know!!

If anyone could give me some advise on passing the above statement that be great. Thanks!

[DrByte]

I see you've already found the thread which addresses this: http://www.zen-cart.com/forum/showth...60#post1099860

[RescoCCC]

I really have to wonder about the validity of the scanning technology SecurityMetrics uses. I'm also subject to quarterly scans from them. When it first started, there were many issues to be addressed; a couple on my end of things, but most on my host's end of things. My host jumped through hoops making changes to the server configuration, and I pass every time now.

HOWEVER, I see many reports of problems with their scans from other Zenners and these reports quite frequently have silly stuff that is obviously not a genuine security issue. Numerous of these reports are followed up later after the info provided by DrByte is passed on to SecurityMetrics and the end result has frequently been a response from them along the lines of "OOPS, our bad, we'll manually enter an exception."