I am using the wp_login_form on a non-secure (http) website. The form is in a modal window, so that you can log in from any page on the website.
Is using the wp_login_form() in this way safe? Thanks, Sascha
WordPress Development Stack Exchange is a question and answer site for WordPress developers and administrators. It only takes a minute to sign up.
Sign up to join this communityIt doesn't matter what function you use to generate the form markup, if you write the code by hand, or if it's in a modal or not. For it to be secure, you absolutely need an SSL certificate.
A man-in-the-middle can eavesdrop all the HTTP requests to a non-secure (HTTP) website, in plain text.
But one of the things that you need to consider is, do a wp_login_form()
alone vulnerable to brute force attacks? If it is, then you need to limit the number of login attempts and implement a secure CAPTCHA. For more info visit Brute Force Attacks.