Form fields have correct autocomplete attributes
Why it matters
Missing or incorrect autocomplete attributes force users to type information their browser or password manager already knows. Password managers rely on both the name attribute and autocomplete to distinguish new-password from current-password — without this signal, they may autofill the wrong credential, prefill nothing, or prompt users to save an incorrect entry. WCAG 2.2 SC 1.3.5 (Identify Input Purpose) requires programmatic purpose identification for common personal data fields. Autofill friction is disproportionately punishing on mobile, where typing is slower and error-prone.
Severity rationale
Low because the failure degrades UX and violates WCAG 2.2 SC 1.3.5 but does not create a direct security or data-loss risk.
Remediation
Add autocomplete and name attributes to every personal-data input. Use new-password on signup and current-password on login — this is the signal password managers use to decide whether to offer to save or fill a credential:
<Input
type="email"
name="email"
autoComplete="email"
placeholder="Work email"
/>
<Input
type="password"
name="password"
autoComplete="new-password"
placeholder="Create password"
/>
Never set autocomplete="off" on password fields — it breaks password manager integration across every browser and forces users to type credentials manually on every visit.
DetectionPro
The detection method for this pattern is part of AuditBuffet Pro.
The full method (what to look for, pass and fail conditions, and how results get reported) ships inside the Conversion Optimization Audit. The pattern definition, severity rationale, and remediation remain openly licensed under CC-BY-4.0.
External references
- wcag:2.2 · 1.3.5 — Identify Input Purpose
Taxons
History
- 2026-04-18·v1.0.0·Initial import from marketing-conversion·automated