php - Unsure if I need SSL or alternative -

i have website not have ssl (due cost reasons). has login form, why believe need ssl. however, don't store passwords, usernames; login form grabs posted username/password , sends via curl https-secured login form, returns yes or no, speak, server.

given this, ssl certificate absolutely necessary, or there lower-cost alternative securing form?

without using tls, username , password exposed listening in on traffic.

this problem, because if website "low value", , doesn't matter if attackers able steal other people's credentials, people reuse passwords.

so not protecting website, exposing users unnecessary risk. attackers can learn usernames , passwords, , try , re-use credentials {email,bank,work,etc} accounts.

as others have pointed out, ssl/tls protects data in motion, not data @ rest. fact don't have sensitive stored data isn't relevant decision of whether protect traffic.

as elon points out, can low assurance free tls certs better nothing.

remember serve @ least entire login page on https, or there's no point in doing @ all.