I have done the same myself. As far as username and password are concerned you either use SSL to secure the transport of them to the server or you can send them encrypted by using a little local javascript. Here is a snippet from a form that gets the password and encypts it:

<input name="passinput" type="password" maxlength="20" size="20" tabindex="2"><
<input type="submit" value="Login" onClick="form.pass.value = hex_sha1(form.passinput.value); form.passinput.value='';" />

This way the password is always sent one way encypted (so you store the pasword encrypted as well and compare the 2 encrypted passwords). You could do a similar thing with usernames but store them unencrypted and just compare the encrytped versions.

That looks the sort of thing Ian, thanks.

I had a try sticking the login page into httpsdocs and it doesn't want to play. Error 404 even though the URL that appears is correct. Looking deeper into their help there are all sorts of server-side setup questions, I didn't have time to see if I could access those.

I was going to contact PC support about it today but might not bother, as I'm sure the certificate problem will arise.

The certificate problem will definitely arise - I use httpsdocs myself and get the same thing. But if it is only username and password then client side hashing as per my example should be good enough.

Not sure why your httpsdocs is not working though - mine is fine (I assume you are changing the http at the start of the url to https?).

I was using relative addressing in the link, as per the PC help files, as I'm starting from a sub-directory in the httpdocs of an existing domain and targeting the httpsdocs in that domain, not the ultimate domain. I did wonder if that may be the issue, so a good idea to try absolute addressing just for the links each way with that page. (And the registration one).

I have never tried doing relative addressing from an http to https page. At least trying an adsolute address would tell you whether the web hosting is working.

Just realised you will also need the sha1.js javascript file.

I will PM you with a link to the file on my private web space.

That's great Ian, I have downloaded it thanks.

I thought there had to be something needed but expected to have to hunt it down .

It entirely depends on what data is being stored/transferred, if you are based in the UK even then you really should be encrypting more than just financial info, any personal details, logins and password etc should be too, as with the new large data protection fines coming in if you got hacked you would have to show you made every reasonable precaution to avoid getting fined.

No problem. I'd forgotten I'd used it.

Good advice thanks, which I shall bear in mind. However I have no current intention of knowingly storing personal information other than the login username and password.

I used to be registered under the DPA and would re-register if I found it necessary.