Just as an additional recourse, and in the odd case where setting up a secure connection is a no-go, I would additionally suggest looking into the stopgap alternative of Semisecure Login Reimagined. It's not enough to thwart e.g. session hijacking type attacks, but it's still way better than nothing.