12

I ran across an article called Put the login on the front page, where the author wants sites to:

[...]put the user name and password box somewhere obvious on the home page like the upper right hand corner. Save me the click.

Is this is a good idea, or not? Or is it better to have a login link go to a separate page, for security (or other reasons)? Even if it adds a step.

Some things I noted from the article:

  • The comments discuss whether this would allow a man-in-the-middle attack due to using plain HTTP on the front page, versus HTTPS.
  • The article (dated 2006) lists sites that do put allow login on the home page, such as Fresh-meat and Slash-dot. Yet when I checked those sites, they had a separate login link, rather than the full login/password/login button as the author states.
  • Those two sites obviously changed their login process in the past five years. I would have presumed for security reasons - but both use HTTP instead of HTTPS, so I'm not sure what the reason was.
Improve this question
6
  • I do not see the security issue here. Can't you just have a form that submits to an https page? I.e. <form action="https://...">
    – Felix
    Commented May 11, 2011 at 15:26
  • If you're suggesting that Fresh-meat/Slashdot do that - when I clicked on their login button, it never displayed a URL in my browser that had HTTPS. Maybe I'm reading it wrong, but it certainly seems to me that those sites are just sending in HTTP. Which might not be a problem given that they aren't banks - but still brings up the issue of why they changed their process.
    – John C
    Commented May 11, 2011 at 15:55
  • The URL that they post your login to is HTTPS. They just then redirect you immediately to a standard HTTP page. This is a pretty common practice. Only the page you are posting to needs to be HTTPS for the request to be secure.
    – Charles Boyung
    Commented Jun 24, 2011 at 12:38
  • @Charles Boyung, so that means that a user wouldn't see the HTTPS page, or the browser's secure icon light up? I looked at the source for Slashdot, and the form post did have one line, //slashdot.org/my/login, with no protocol listed. Then elsewhere I found a script that inserts https// into something, I wasn't sure - but it seems possible it was the forms post address. :)
    – John C
    Commented Jun 24, 2011 at 13:10
  • 1
    The login form itself and any pages you view after you log in need to use HTTPS. See OWASP's Transport Layer Protection Cheat Sheet.
    – ajlane
    Commented Nov 8, 2013 at 5:48

6 Answers 6

Reset to default
12

Letting users log in from the front page (or any page) is certainly more user friendly. It's always jarring to be taken away from the content or tool you want access to.

Smashing Magazine recently released an article suggesting this as well.

You really should make sure that the login pages are secure, but why not make your whole site secure? If you only make the login page secure people can still intercept cookies (assuming that you are using cookies) and get around having to capture login info.

Bruce Schneier has an article about hijacking people's connections to websites.

SSL certificates aren't all that expensive these days.

Improve this answer
3
  • I do plan on getting an SSL certificate, but the article (comments) called using HTTPS on the homepage, "a scalability disaster". :) Was that just exaggeration? Are there likely to be noticeable performance problems securing an entire site? Assuming a small-medium sized site, not Amazon. :)
    – John C
    Commented May 10, 2011 at 18:36
  • There are a couple of good discussions on Stack Overflow about this. stackoverflow.com/questions/548029/… and stackoverflow.com/questions/149274/http-vs-https-performance
    – bendur
    Commented May 10, 2011 at 18:41
  • Well, I'm sold :) And the Smashing Magazine article also convinced me to finally ask how to make Django passwords visible, something else I had been dithering on. :)
    – John C
    Commented May 10, 2011 at 20:11
6

Yes it is a great practice, especially critical for services you always have to log in for. Customers appreciate it a lot. Even a log in button helps the user a lot.

I cannot comment on the security as that is not my expertise. I can throw some examples down.

List of HTTPS or non-homepage log-ins:

List of http log in right from the home page sites:

Improve this answer
3

On many pages the log in is only important for certain actions (like ordering on amazon.com or bidding on ebay.com). In this case I think the upper right corner (prime real estate) can be used for other things. Other pages can't be used at all without signing in (facebook.com, gmail.com etc.).

So my take would be: There is no general rule for this - it comes down to how important the log in is on your page.

Additional thoughts: From an analytics point of view it can be great to see which users do what on your page, so having more signed in users could be helpful and a prominent login area could help to achieve that.

Improve this answer
0

The top right is a BLIND SPOT. People only look up there when they want something, e.g. if someone cannot find what they want they will look for the searchbox in the top-right. Same goes for account buttons, contact us and so forth. Note that StackExchange does this. Stick to the convention and also consider an Ajax login where you click on the link, a small overlay/dropdown shows and page doesn't reload to a 'login success' page taking them away from where they were.

Also consider the benefits of the 'going to a different page' technique. Some people prefer a form that submits to go to a different page - clunkiness means it is happening in their minds.

For added usability testing, put Clickheat on the homepage and see where people go:

http://www.labsmedia.com/clickheat/index.html

Improve this answer
1
  • I realize the quote mentioned the top-right corner, but the location of the button, wasn't really my main concern. I was more concerned with whether the homepage should have a name/password field with login button, as opposed to a separate link. Where they should be located on the page, is another question.
    – John C
    Commented May 11, 2011 at 12:46
0

One question to consider with this, is are the majority of visitors to your homepage returning users (and therefore looking to log in) or are they new visitors that you want to sign up?

If you're skewed heavily in one direction, go for that (e.g. if 90% of visitors don't already have an account, you probably dont' need to login form on the homepage, because focus should be on signing up). If it's 50-50 or more for returning visitors, the log in on the homepage would certainly save hassle for a significant number of users, so as long as it's done unobtrusively to those who don't need the login form, it seems like a good idea to have it on the homepage.

If you're a new app looking to build up user numbers, the focus should be on one main sign up button, and an additional form or button that could pull focus from that is best to avoid.

Improve this answer
0

It is easier for your users to login directly on the home page (or even on every page via navigation). However, one thing you need to make sure is that the page is protected against Cross-site scripting (XSS). That is you need to make sure it is not possible to insert any form of unwanted scripting into the page the login resides on.

This is especially important on the login page, as this is potentially the easiest place to "grab" the password of a user. This (still) looks exactly like your legitimate login (including a proper URL), so users have no real chance to detect this as a scam.

If that login page is an extra bare-bone page, XSS protection is easy to do and to make sure no new problems are coming up. If the page you login to has lots of data (and potentially code) that is coming from all kind of sources it might easier to overlook a place where XSS is possible.

Also note that https does not protect against most XSS. I only protects against adding malicous code in between the browser and the server, but not against data entered somewhere on the website or inserted via links or similar.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.