You entire site needs to be available only over https. Otherwise login cookies and passwords can be stolen.

How to setup a free SSL certificate on apache. https://www.digitalocean.com/community/tutorials/how-to-set-...