The website might not be designed to have credentials or login forms, but now you have allowed attackers to place fake login forms on your website. And given th

The website might not be designed to have credentials or login forms, but now you have allowed attackers to place fake login forms on your website. And given the prevalence of password reuse for the general population, attackers can easily harvest real passwords this way. Not to mention injected ads which used to be very common in the late 2000s.