Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have an newly installed SSL certificate on my website and I am trying to figure out how to make some pages point specifically to https and other point only to http. For example, if someone is on my website browsing my webpages via https, and I only need my testimonials and about us page to be http, is this possible? I know this is possible with hard coding all of the links on the site but I am and already have setup relative links. Is there a way to maybe add a setting in the .htaccess file that will point the server to http when someone trys to visit my testimonials and about us page?

share|improve this question
add comment

1 Answer

Yes. You can use rewrite rules with regular expressions which match the URLs which are supposed to be secure, and rewrite all access to the https URLs. See the mod_rewrite documentation.

Although your examples are pages which don't need SSL but are being accessed that way anyway, presumably the more serious concern is mixing in pages which need to only be https. It's easiest if you just do one direction, but it's not much more work to do the inverse matches and rewrite as well.

share|improve this answer
    
Thanks for the response. I am by no means a regular expressions expert. Do you happen to know the code for this task? The 2 pages I am needing to point to http are testimonials.php and about_us.php. Everything else is https. I appreciate the help. –  three3 Dec 4 '10 at 3:23
    
Is it really worth the bother? What is the downside of having these sites be accessed over SSL? Are you getting enough load that the added CPU time is a problem, but only for those pages? It sounds like 99% of the site you want encrypted anyway; why not just make it 100%? –  mattdm Dec 4 '10 at 3:25
    
I would have the site 100% accesses over SSL if I could. For example, on the testimonials page, there is an embedded video from Vimeo that is http. They do not currently offer an https option for their embedded videos. When someone visits the testimonials page, they receive the dreaded message, "Do you want to display the contents that were only sent over a securely?" I do not want my customers to see that message. –  three3 Dec 4 '10 at 3:30
    
Reasonable enough. The expressions in this case shouldn't be hard, and since security is involved, it's really better for you to understand them than to copy-paste someone's answer here. Every time I work with mod_rewrite, I end up looking at the docs, so I'm telling you this seriously, not just to be obnoxious or condescending: sure, I could go figure out the exact rewrite rules you need, but so can you, and you'll get a lot more benefit out of doing it than I will. –  mattdm Dec 4 '10 at 3:36
    
That said, if you come up with specific problems while working on it, it's fine to ask. –  mattdm Dec 4 '10 at 22:53
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.