For sites that are available via both HTTP and HTTPS, Secure Login
module ensures that the user login and other forms are submitted
securely via HTTPS, thus preventing passwords and other private user
data from being transmitted in the clear. Secure Login module locks
down not just the user/login page but also any page containing the
user login block, and any other forms that you configure to be
For Drupal 7 and 8, Secure Login module enforces secure authenticated
session cookies, thus preventing session hijacking. For previous
versions of Drupal, PHP's session.cookie_secure flag must be enabled
on the HTTPS site to enforce secure session cookies.
With Login Security module, a site administrator may protect and
restrict access by adding access control features to the login forms
(default login form in /user and the block called "login form block").
Enabling this module, a site administrator may
limit the number of invalid login attempts before blocking accounts,
or deny access by IP address, temporarily or permanently. A set of
notifications by email or Nagios may help the site administrator to
know when something is happening with the login form of their site:
password and account guessing, bruteforce login attempts or just
unexpected behaviour with the login operation.