I know that protecting all pages with SSL will slow down the website
and add overhead to the server resources.
This is true. You shouldn't just throw on SSL on a whim. You should make an informed decision about it. While SSL does introduce security benefits, it does come at the cost of performance. It's important to remember that you can always throw technology solutions at a performance problem so I would make sure you're happy with your security first, then try and deal with any performance issues you may come across.
The main takeaway is, if SSL solves your security concerns go ahead and use it.
Why is it considered bad practice to only protect only pages where the
user's password is entered instead of the whole site?
It's not. Well not necessarily. You really need to have a look at what data you're trying to protect, and what at attacks you're trying to prevent.
Common areas to consider:
- Is there sensitive data on your whole site, or just on a finite set of pages?
- Is it going to be easy to implement SSL on some pages, rather than all pages?
- Are you dealing with any credit card data
- Do you have users that log into your site & member pages with private data
- Do you capture data through forms, what sort of data is it?
Sometimes you may only want to secure parts of your website, such as a login page and any member pages. The public facing parts of your website may not require SSL and making them HTTP could give you considerable performance benefits.
Some people implement SSL on their whole site because it simplifies things.
Of course implementing SSL can be tricky, and sometimes the effort in trying to have SSL on one page but not the other can mean considerably more work. SSL on your whole site helps future proof it, cuts down on developer complexly, can avoid bugs and error messages to users (or worse still accidentally exposing sensitive data over HTTP).
Also, instead of using something like https://mysite.com/login.php,
should I maybe change to https in this way:
There are many ways to implement a login (and security) with PHP but you haven't really gone into enough detail here to safely comment. You should first outline what you're trying to achieve, then give an overview of how you're going to go about it, and then you can start to consider the pros and cons of alternatives.