Setup an SSL certificate!
That's really the only answer here, especially if you are having people login. An attacker on the same network as your users can sniff everything, and an attacker who gets themselves in the middle can modify your response to remove any client-side protections you try to enable. I'd say that trying to secure a non-HTTPS connection is like trying to build a house without a foundation, but it's more like trying to build a sandcastle on a sandbar that is only exposed at low tide and covered in 10 feet of water at high tide. It's literally impossible.
These days you can easily get free certificates from let's encrypt. If your hosting company can't support SSL then it is time to move to a new one. Moving to a new company will be easier than trying to build privacy without HTTPS.
As a software provider though
If you are providing software and so are not responsible for deployment, and thus cannot provide certificates, then attempting to secure an HTTP connection is an even more dangerous approach. The problem is that if you say "We provide X safe guards so HTTPS is unnecessary!" your customers will believe you, and when your safeguards are inevitably breached you will be held liable. Don't do it. I have had to deploy a lot of 3rd party software systems so here are the sorts of things you want to do:
- Give suggestions for ways that they can add SSL via infrastructure, by doing things like putting a load balancer on top and using it for SSL termination. Most cloud providers can automatically provide SSL for their own load balancers.
- Provide a way for the end user to provide an SSL certificate which your software will use (do them a favor and make sure there is an option to automatically configure your software for automatic deployments)
- Provide some pre-baked options for automatic certificate management via Let's Encrypt/certbot.