I am using the wp_login_form on a non-secure (http) website. The form is in a modal window, so that you can log in from any page on the website.

Is using the wp_login_form() in this way safe? Thanks, Sascha

2 Answers 2


It doesn't matter what function you use to generate the form markup, if you write the code by hand, or if it's in a modal or not. For it to be secure, you absolutely need an SSL certificate.


A man-in-the-middle can eavesdrop all the HTTP requests to a non-secure (HTTP) website, in plain text.

But one of the things that you need to consider is, do a wp_login_form() alone vulnerable to brute force attacks? If it is, then you need to limit the number of login attempts and implement a secure CAPTCHA. For more info visit Brute Force Attacks.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.