whenever you can, avoid reinventing the wheel - if you can, reuse and improve your system from project to project, peer reveiwing each time.
keep the password obscured - don't show text on the page, transmit over HTTPS, don't log in the clear on the back end, store safely in database. Basically wherever the password goes, privacy should be maintained
do log errors; don't show too much info to users. Specially the "bad password" vs. "bad username" - don't tell the attacker that they have found a valid username, tell them "invalid credentials" or "bad username/password" without specifics. But do, on the back end, log the problems - is this a repeat of a username? what are the characteristics of the current failure? In a high end system, you'd have something watching and alerting admins if the behavior showed attack-like qualities.
consider a password locking system and what fits for the users. For optimal reuse have configuration settings for # bad logins before lockout and # of minutes of lockout before re-enablement (with a setting for "manual reset only")
carefully consider any feature for password reset, these are hard to craft securely.
consider your users and anything they may need for authenticating your server - many aren't SSL/certificate savvy, so what can you do to minimize a user giving their password for your site to a hacker?
Use HTTPS for your entire site, including the marketing pages. Add the HSTS header.
If your target audience is computer savvy enough, then avoid the traditional username & password login completely. Offload that to a good federated login system, such as multi-provider OpenID, or Facebook Connect or Google's login.
For the functionality on your site that has higher security needs (the important stuff) use CSRF tokens.
Skip building your own login page entirely... If you have the option use Claims Based Authentication and identity federation instead: http://claimsid.codeplex.com/ (that link is particular to .NET, but it has a good primer on CBA).
This page contains a lot of information regarding how to securely use TLS for your website. While there are other concerns for your authentication system (such as password storage, session management etc) this will still provide a lot of good information.