I use a SSL in my main domain, that is the one my clients access.

However, I have a second domain with the same content (including login credentials) that I use only for test and development. 

Should I secure this test domain too?

Yes, you should. You might need to test if e.g. a particular request works over HTTPS, but testing on a production system is a bad idea (the production system should remain stable), and your test system should match the production system as closely as possible. Secondly, if you're sharing the login details between domains, why shouldn't the test domain be secured as well?

If the price of the certificate is a problem, what you can do is:


Get a free cert from Let's Encrypt.
Use a self-signed cert.
Set up your own internal certificate authority for the test domain (probably the best option).

