The easiest thing for you to do is have the entire site in SSL. Is there a particular reason you only want the login credentials passed using secure sockets layer? James Moseley