Several searches only turned up questions about encrypting login info on the server side. Does Mediawiki encrypt logins after you type them in the browser and send them? (to prevent a man-in-the-middle from reading them in transit and taking over an account)
2 Answers
Nope, they're submitted as clear form data on the POST request. You definitely need SSL on your login page.
answered Sep 11, 2017 at 19:10
No serious web application encrypts logins on the server side. At most it would give you an illusion of safety, as opposed to the real safety provided by HTTPS. If the web traffic is unencrypted, the attacker can arbitrarily alter the data you send or receive (for example, inject malicious Javascript that logs the password as you type it; or wait until you log in and then copy your cookies and issue commands in your name).
