A malicious attacker can intercept an insecure HTTP page hosting a secure HTTPS form, replacing or spoofing the original form.
Secure landing pages that host sensitive forms by using HTTPS instead of HTTP