http transports data in clear text from the user's browser to the web server, and from the web server to the user's browser. If someone sniffs the content being passed, then yes, they can see a usernamd and password.

https means that the browser and the webserver both encrypt data before sending it, and decrypt it upon receipt. This means that sensitive data such as usernames, passwords, credit card numbers, etc, are not sent in clear text.

if you want your entire DNN site to be secure in the sense that all data in and out is encrypted, then you can obtain a certificate and have it installed by your web host. You could also ensure that in IIS the virtual directory requires https for the entire site, and then enable SSL in DNN. Do _not_ select 'enforce SSL' in this case, and I think you could get by without marking any of the pages as secure. SSL will be enforced by IIS.

Or, just set every page as secure and don't set it at the IIS virtual directory, and in this case it doesn't matter if you set 'enforce SSL' or not.

However, there is a bit of overhead with https. So what is more typical is that you get the certificate and install it. Then enable SSL in DNN and for each page you want secure (such as the logon page) set it to secure. If you want DNN not to send the other pages in https, you can also select 'enforce SSL' - interestingly, what that means is that if a page is not marked as SSL, DNN will force a switch from https to http when moving to that page, and then back to https when coming to a secure page. Else, it might allow even pages not marked as secure to also be delivered via https.

Hope that is helpful. I think I've described it accurately. Corrections welcome.