Add bank-grade security powered by Google to your site. Each login requires a new, unique, time restrained OTP (one time password) your phone generates. Even if someone knows your password they wont be able to login. If someone tricks you into clicking ?remember password on an unsafe computer it wont matter! If someone steals an old OTP even that wont matter because theyre valid for only 2 minutes!