Is wp_login_form secure on a non secure page?

Question

I am using the wp_login_form on a non-secure (http) website. The form is in a modal window, so that you can log in from any page on the website.

Is using the wp_login_form() in this way safe? Thanks, Sascha

Answer 1

It doesn't matter what function you use to generate the form markup, if you write the code by hand, or if it's in a modal or not. For it to be secure, you absolutely need an SSL certificate.

Answer 2

A man-in-the-middle can eavesdrop all the HTTP requests to a non-secure (HTTP) website, in plain text.

But one of the things that you need to consider is, do a wp_login_form() alone vulnerable to brute force attacks? If it is, then you need to limit the number of login attempts and implement a secure CAPTCHA. For more info visit Brute Force Attacks.