FINDINGform.
Jump to what to doform.link_in_subject
The subject field contains a URL with a scheme, a www. address or an email address.
What it looks at#
Scans the subject field for:
- a URL with a scheme (
https://...) or awww.prefix; - an email address.
A bare domain does not fire: “Problem with mystore.com” and “Order from shop.se” are ordinary customer subjects. That is the difference from form.link_in_name.
location is subject, never the value.
Why it matters#
Link-drop bots put their URL wherever your form forwards or displays text, and subject lines are often copied straight into a notification email or a ticket title.
What to do#
Low severity. Read it with the message findings before acting; on its own it is a reason to look.