Force SCLogin to a https page?

When I look at the page using F12 in Firefox I get a warning on the console tab saying : Password fields present on an insecure (http://) page. This is a security risk that allows user login credentials to be stolen.

Are you looking at the https version of the page in Firefox? Can you verify in the source that the setting is working and the form is directed to submit to https? Could you send a specific URL where we can see the behavior in action?

-Melissa

SCLogin is a module. It can't force the actual page it's on to be https. In many cases, users will put the SCLogin module on every page of their site, not just one specific page as well.

If you want to make a specific page of your site always load via https, that should be done with an .htaccess rule, an SEO or other routing extension.

As Melissa hinted at above, the Encrypt Login Form setting in the SCLogin module ensures that the form is *submitted* to a secure/https URL. The page it's placed on is out of the module's control.

One final note, it's becoming more en vogue nowaydays to have every page of your site load over https, whether there's a security reason to do so or not. Browsers and search engines are starting to promote pages that use https more and penalize (in some small way) pages that only load over http. If you have the ability to make everything https (and services like Cloudflare make this exceptionally easy), we'd recommend you do so.

I hope that helps explain further,
Alex

Does this mean that the username and password are encrypted (https) as they travel to the URL where they are posted?

Correct. The credentials are transmitted securely.

The issues that browsers have nowadays is that even if they are transmitted securely, if you're entering them on a non-secure page, there's additional risk that some malicious file running on the page could still be scraping the data before the "login" button is actually clicked. That's a more minimal risk, but at this point, it's SSL or bust to be seen in a good light in a browsers eyes.

I mentioned it above, but I'd recommend (and we use) Cloudflare. It's a CDN for your website that can add SSL to all your pages automatically. We get no benefits from you looking into them, just an easy solution.

All the best,
Alex