up vote 1 down vote favorite
share [g+] share [fb]

I'm running a WordPress site on a shared Apache server on Dreamhost. I already have define('FORCE_SSL_ADMIN', true); set (and working) in my wp-config.php so that SSL is used for the /wp-admin/ directory.

Can you point me to a .htaccess set of rules that will still maintain /wp-admin/ over https, but redirect any other directory/URL to use http? All help is appreciated. Thanks.

link|improve this question
Why not just use https for everything? As long as you're setting it up, you might as well take full advantage. Unless, I suppose, you're using a self-signed cert, in which case it wouldn't be ideal. – ErikA May 4 '11 at 13:33
I use a cdn, and that is currently only set up for http. Plus, Google results are pointing to http and https. I would rather just have http. – Kevin Worthington May 4 '11 at 22:29
@ErikA There is a huge performance risk to deal with when 'just' using HTTPS. Every page which is requested needs to go through the 3 way handshake and every page that is serviced also comes with the overhead of encryption. – emtunc May 19 '11 at 21:34
@emtunc - yes, there is a bit of overhead, but surely not a huge performance hit. If your server is that close to pegging its CPU that it cannot handle serving via SSL, then you have other problems to solve. – ErikA May 19 '11 at 21:58
feedback

1 Answer

up vote 4 down vote accepted 
RewriteCond %{REQUEST_URI} !^/wp-admin/
RewriteCond %{HTTPS} on
RewriteCond %{HTTP_HOST} (.*)
RewriteRule ^/(.*) http://%1/$1 [L,R,QSA]

Note that if your admin interface loads images, CSS, JS, etc. out of a directory other than /wp-admin/ (which by default it does), this will probably make a warning appear on your browser (and will likely compromise the security you were trying to gain). You can add something like:

RewriteCond %{REQUEST_URI} !\.(js|css|jpg|gif|png)$

to resolve that, just keep adding extensions until you've got everything covered.

link|improve this answer
I tried the above. When I visit the root domain via https it doesn't redirect to http. Any ideas? – Kevin Worthington May 4 '11 at 22:28
1  
In a .htaccess, drop the leading / from the RewriteRule. – BMDan May 5 '11 at 2:46
Yes +1! +1 for your answer and the checkmark! Thank you! – Kevin Worthington May 5 '11 at 14:23
A .js is coming over http, rather than https. I have: RewriteCond %{REQUEST_URI} !\.(js|css|jpg|gif|png)$ right after the first line that has the /wp-admin/. Is that correct? – Kevin Worthington May 5 '11 at 15:00
At first glance at least, that looks like it should work. Is it? Note that it won't rewrite broken HTML; if the HTML tells the browser to fetch the JS via HTTP, that will still happen. This is just to prevent errors from appearing when the HTML is correct. – BMDan May 5 '11 at 21:54
show 1 more comment
feedback

Your Answer

 
or
required, but never shown
discard

Not the answer you're looking for? Browse other questions tagged or ask your own question.