If you do have SSL certificate on your domain it would be shame not to use it for WordPress login. Since WordPress sends passwords as plain-text, it would be great thing if we would be redirected to HTTPS version for every login (even if we forget to specify it).
Solution lies in adding few lines to your .htaccess file:
RewriteCond %{HTTPS} off
RewriteRule ^wordpress/wp-(login.php|admin/)(.*)$ https://%{SERVER_NAME}%{REQUEST_URI} [R=301,L]This code checks whether we are going to login or admin pages. If we are and https is not protocol of our choice, it will simply rewrite request.
P.S. This example was taken from my pages where I have WordPress installed in sub-directory named wordpress) If you have it installed in some other directory, adjust accordingly.
P.P.S. Do not forget to set FORCE_SSL_LOGIN and FORCE_SSL_ADMIN also.