: Should every page on every site be behind SSL? This question stemmed from a discussion here: Ad networks that will serve via HTTPS? My question to the OP was "is it necessary to have every

@Angela700

If you took precautions to never visit the non-SSL areas of a site while logged in, and if there was a logout process that properly deleted the authenticating session cookie, then it should be fine. Of course, the more admin-level users you have, the greater the chance that this will never happen.

A more ideal way to do this, for the Wordpress example: move (not copy) /wp-admin to a different domain under HTTPS. That way, you won't have to worry about logging out to make sure your new post got published okay, because cookies are per domain. A cookie for admin.mysite.tld won't be in the request headers for mysite.tld, so there's nothing unencrypted to be sniffed and hijacked.

(Granted, if it's a single-author/admin Wordpress site, just tunneling through a VPN when accessing it over a wi-fi hotspot would have the same effect, without the mess of tweaking WP to work across two domains.)

Vote Up Vote Down