Secure Login

Secure Login module enables the user login and other forms to be submitted securely via HTTPS, thus preventing passwords and other private user data from being transmitted in clear text. Secure Login module locks down not just the user/login page but also any page containing the user login block (or other forms that you configure to be secured).

For Drupal 7 and 8, Secure Login module enforces secure authenticated session cookies, thus preventing session hijacking. For previous versions of Drupal, PHP's session.cookie_secure flag must be enabled on the HTTPS site to enforce secure authenticated session cookies.

A word about Drupal 7's $conf['https'] setting

Secure Login is intended for sites that want to offer anonymous sessions via HTTP or HTTPS and authenticated sessions only via HTTPS. Anonymous insecure sessions are migrated to authenticated secure sessions upon login, with all session data intact. Secure Login is designed to work with Drupal 7's $conf['https'] at its default value, FALSE.

If you were to change $conf['https'] to TRUE, you would enable mixed-mode (HTTPS and HTTP) authenticated sessions: both secure and insecure session cookies are set when a user logs in to the HTTPS site. Other contributed modules, such as Secure Pages, may assist you with implementing mixed-mode authenticated sessions.

Pro tip: HSTS

To help protect against SSL stripping attacks, add the Strict-Transport-Security header in your webserver configuration or install HSTS module.

Drupal 8

The Drupal 8 version of Secure Login should be fully functional. Note, however, that in Drupal 8, anonymous insecure sessions are not migrated to authenticated secure sessions upon login; instead, a new session is created. Drupal 7 to Drupal 8 configuration migration hasn't been tested.


The Drupal 7 and 8 versions of Secure Login were developed by mfb, along with other contributors from the community. Secure Login module is currently maintained by mfb.

Project Information