If your the only person accessing the website then it's only network you access the website need to be secure. For example, let's say you only operate this blog from your home network. If your home network was compromised by an hacker and they was ARP spoofing on network to capture your credentials or had control over your router to log packets.
If you want to go for a step futher on tighting up the security:
- Client request login page
- Server gives them login page with handshake key
- Client hashes the password and does password then appends handshake key and hashes that.
- Server get password from DB which is hashed and handshake key and ensure that is valid before processing it. Ensure the handshake key isn't managed by the client.
- If handshake passwords, compare password to DB password.
This would prevent hacker if someone compromised the local network and got your hashed password they wouldn't able to login to your account since they wouldn't know the password for the handshake.