Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I'm planning on building an application wherein my users can create accounts on it, email other users, etc. The site will also have forums, chat, etc. It will also need to process credit cards. I'm trying to decide which parts of the site should be in https. Now I'm wondering if there are any problems with just having the entire site under SSL.

Any suggestions?

share|improve this question

migrated from stackoverflow.com Sep 12 '11 at 9:59

This question came from our site for professional and enthusiast programmers.

1  
StackON, forgive me for mentioning this, but you have been a member of SF for two months. In this time, you have asked seven questions, but accepted the answer for none. Local etiquette is that after a reasonable time, you accept the best answer for any given question by clicking the "tick" outline by it, and that helps drive SF's reputation system. If you don't do this, we see a big red warning "0% accept rate" by your username, which may discourage some people from answering your questions. If you had time to go through your old questions and accept an answer for each, that would be good. –  MadHatter Sep 12 '11 at 13:20
    
@MadHatter - was having problems with SF. Problem resolved. Thanks. –  StackOverflowNewbie Sep 12 '11 at 22:56
    
No worries, and thanks for acting so swiftly. –  MadHatter Sep 13 '11 at 6:35
add comment

3 Answers

up vote 6 down vote accepted

There will be some processing overhead to establish the SSL connection, but on modern boxes and lightly loaded web sites that probably won't be very noticeable.

If you have forums where users are posting images sourced from outside your website, people will see an SSL mixed content warning (your site is SSL, but there are assets that are not SSL). Depending on your user population, that may freak out some people.

share|improve this answer
1  
+1 for the comment about mixed content warnings. –  snap Sep 12 '11 at 11:51
    
@cjc - if I were to just have some parts of the site as secured (instead of trying to secure the entire site and have issues with mixed content warnings), any tips on best practices? Maybe I put all my resources (css, js, images, etc.) in secured folder? Then secured and unsecured pages can reference those resources. For the secured pages, I won't (hopefully) run into mixed content warnings? –  StackOverflowNewbie Sep 12 '11 at 23:01
add comment

If you're handling credit card data, it's worth a read of the appropriate standards as well. You need to be PCI-DSS compliant. Wikipedia's got pointers to the appropriate documentation.

share|improve this answer
add comment

Be reminder there is some tradeoff when using SSL.

It will increase the overhead communication which will somehow make your site get slower response. Also, your client need to have a SSL certificate in order to access your server.

Something which is important, sensitive data should be encrypted , like Login, credential information.

share|improve this answer
2  
Why would clients need certificates to validate? The original question doesn't suggest that this feature will be turned on. –  cjc Sep 12 '11 at 10:34
2  
-1. For 99.99% of your users, the tiny bit of overhead that SSL introduces will never be noticed. Additionally, if you run into server CPU load issues after turning on SSL, it's likely you have other issued to deal with as well. –  EEAA Sep 12 '11 at 17:31
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.