Take the 2-minute tour ×
User Experience Stack Exchange is a question and answer site for user experience researchers and experts. It's 100% free, no registration required.

I ran across an article called Put the login on the front page, where the author wants sites to:

[...]put the user name and password box somewhere obvious on the home page like the upper right hand corner. Save me the click.

Is this is a good idea, or not? Or is it better to have a login link go to a separate page, for security (or other reasons)? Even if it adds a step.

Some things I noted from the article:

  • The comments discuss whether this would allow a man-in-the-middle attack due to using plain HTTP on the front page, versus HTTPS.
  • The article (dated 2006) lists sites that do put allow login on the home page, such as Fresh-meat and Slash-dot. Yet when I checked those sites, they had a separate login link, rather than the full login/password/login button as the author states.
  • Those two sites obviously changed their login process in the past five years. I would have presumed for security reasons - but both use HTTP instead of HTTPS, so I'm not sure what the reason was.
share|improve this question
    
I do not see the security issue here. Can't you just have a form that submits to an https page? I.e. <form action="https://..."> –  Felix May 11 '11 at 15:26
    
If you're suggesting that Fresh-meat/Slashdot do that - when I clicked on their login button, it never displayed a URL in my browser that had HTTPS. Maybe I'm reading it wrong, but it certainly seems to me that those sites are just sending in HTTP. Which might not be a problem given that they aren't banks - but still brings up the issue of why they changed their process. –  John C May 11 '11 at 15:55
    
The URL that they post your login to is HTTPS. They just then redirect you immediately to a standard HTTP page. This is a pretty common practice. Only the page you are posting to needs to be HTTPS for the request to be secure. –  Charles Boyung Jun 24 '11 at 12:38
    
@Charles Boyung, so that means that a user wouldn't see the HTTPS page, or the browser's secure icon light up? I looked at the source for Slashdot, and the form post did have one line, //slashdot.org/my/login, with no protocol listed. Then elsewhere I found a script that inserts https// into something, I wasn't sure - but it seems possible it was the forms post address. :) –  John C Jun 24 '11 at 13:10
    
Right, they would not see the little icon for HTTPS. In testing I've done, most users don't notice it when it does show up, so I don't think that's really that important. –  Charles Boyung Jun 24 '11 at 14:48
show 1 more comment

5 Answers

up vote 12 down vote accepted

Letting users log in from the front page (or any page) is certainly more user friendly. It's always jarring to be taken away from the content or tool you want access to.

Smashing Magazine recently released an article suggesting this as well.

You really should make sure that the login pages are secure, but why not make your whole site secure? If you only make the login page secure people can still intercept cookies (assuming that you are using cookies) and get around having to capture login info.

Bruce Schneier has an article about hijacking people's connections to websites.

SSL certificates aren't all that expensive these days.

share|improve this answer
    
I do plan on getting an SSL certificate, but the article (comments) called using HTTPS on the homepage, "a scalability disaster". :) Was that just exaggeration? Are there likely to be noticeable performance problems securing an entire site? Assuming a small-medium sized site, not Amazon. :) –  John C May 10 '11 at 18:36
    
There are a couple of good discussions on Stack Overflow about this. stackoverflow.com/questions/548029/… and stackoverflow.com/questions/149274/http-vs-https-performance –  Ben Durnell May 10 '11 at 18:41
    
Well, I'm sold :) And the Smashing Magazine article also convinced me to finally ask how to make Django passwords visible, something else I had been dithering on. :) –  John C May 10 '11 at 20:11
add comment

One question to consider with this, is are the majority of visitors to your homepage returning users (and therefore looking to log in) or are they new visitors that you want to sign up?

If you're skewed heavily in one direction, go for that (e.g. if 90% of visitors don't already have an account, you probably dont' need to login form on the homepage, because focus should be on signing up). If it's 50-50 or more for returning visitors, the log in on the homepage would certainly save hassle for a significant number of users, so as long as it's done unobtrusively to those who don't need the login form, it seems like a good idea to have it on the homepage.

If you're a new app looking to build up user numbers, the focus should be on one main sign up button, and an additional form or button that could pull focus from that is best to avoid.

share|improve this answer
add comment

The top right is a BLIND SPOT. People only look up there when they want something, e.g. if someone cannot find what they want they will look for the searchbox in the top-right. Same goes for account buttons, contact us and so forth. Note that StackExchange does this. Stick to the convention and also consider an Ajax login where you click on the link, a small overlay/dropdown shows and page doesn't reload to a 'login success' page taking them away from where they were.

Also consider the benefits of the 'going to a different page' technique. Some people prefer a form that submits to go to a different page - clunkiness means it is happening in their minds.

For added usability testing, put Clickheat on the homepage and see where people go:

http://www.labsmedia.com/clickheat/index.html

share|improve this answer
    
I realize the quote mentioned the top-right corner, but the location of the button, wasn't really my main concern. I was more concerned with whether the homepage should have a name/password field with login button, as opposed to a separate link. Where they should be located on the page, is another question. –  John C May 11 '11 at 12:46
add comment

On many pages the log in is only important for certain actions (like ordering on amazon.com or bidding on ebay.com). In this case I think the upper right corner (prime real estate) can be used for other things. Other pages can't be used at all without signing in (facebook.com, gmail.com etc.).

So my take would be: There is no general rule for this - it comes down to how important the log in is on your page.

Additional thoughts: From an analytics point of view it can be great to see which users do what on your page, so having more signed in users could be helpful and a prominent login area could help to achieve that.

share|improve this answer
add comment

Yes it is a great practice, especially critical for services you always have to log in for. Customers appreciate it a lot. Even a log in button helps the user a lot.

I cannot comment on the security as that is not my expertise. I can throw some examples down.

List of HTTPS or non-homepage log-ins:

List of http log in right from the home page sites:

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.