[sullof]

You can inspect the website and detect a backdoor. It is not easy, but nobody would risk to be caught doing that. On the server side, we have no possibility of knowing what happens.

[sullof]

Also, you could use an extension to generate the signature. The password, in this case, would never be passed to the client.