Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have a Wordpress website with PHP APC caching enabled where I'd like to encrypt all requests to http://www.domain.com/wp-login.php* and http://www.domain.com/dashboard?action=profile. I'd like to force an unencrypted connection to everything else.

I can get this to work but the configuration is extremely ugly and hacked together. My problem is I still have to pass the two strings I'd like to encrypt to the PHP engine. There's gotta be a better way to do this instead of duplicating so much.

server {
    listen       443;
    ssl     on;
    ssl_certificate /etc/nginx/ssl/new/server.crt;
    ssl_certificate_key /etc/nginx/ssl/new/server.key;

    server_name  www.domain.com domain.com;
    root   /var/www;
    index  index.php index.html index.htm;

    location / {
        try_files $uri $uri/ /index.php?$args;
    }

    location ~ \wp-login.php.* {
        ##Stuff to send requests to the PHP engine here
    }

    location ~ \dashboard?action=profile.* {
        ##Stuff to send requests to the PHP engine here
    }

    location ~ \.php$ {
        ##Stuff to send requests to the PHP engine here 
    }
}

server {
    listen       80;

    server_name  www.domain.com domain.com;
    root   /var/www;
    index  index.php index.html index.htm;

    location / {
        try_files $uri $uri/ /index.php?$args;
    }

    location ~ \wp-login.php.* {
        ##Stuff to send requests to the PHP engine here
    }

    location ~ \dashboard?action=profile.* {
        ##Stuff to send requests to the PHP engine here
    }

    location ~ \.php$ {
        ##Stuff to send requests to the PHP engine here 
    }

    location ~ \dashboard/\?action\=profile$ {
        rewrite ^ https://$http_host$request_uri? permanent;    
    }

    location ~ \wp-login.php.* {
        rewrite ^ https://$http_host$request_uri? permanent;    
    }
}
share|improve this question
    
You don't want to protect only the login pages; this doesn't reduce your vulnerability to cookie stealing attacks such as Firesheep. You have to go 100% HTTPS to mitigate this. –  Michael Hampton Sep 15 '13 at 22:40
    
@MichaelHampton I thought that was why WordPress had all those random strings in the cookies? Back in the 'day you had to put those into wp-config yourself during install. –  Paul Sep 15 '13 at 23:35

1 Answer 1

up vote 2 down vote accepted

As far as requiring SSL for login and dashboard access, there are a number of solutions. One simple one is to edit wp-config.php and just above the line that states /* That's all, stop editing! Happy blogging. */ add define('FORCE_SSL_ADMIN', true);.

Personally, I don't worry about abuse of https version of a site as search engines will by default link to non-https versions of sites, so unless your users are regularly logging in, only a tiny fraction of them would be using the https version of the site, thus negligible increase in server load, but YMMV.

You might find many of the tips in this Ars Technica article, Web Served, part 5: A blog of your own, useful.

You may also want to review the common configuration pitfalls at nginx.org.

share|improve this answer
    
After all that hassle over messing with the nGinX config file, I found the FORCE_SSL_ADMIN constant you referred to. It worked like a champ. –  adbertram Sep 16 '13 at 2:05
    
You're welcome! You may also find the WordPress Q&A site helpful. –  Paul Sep 16 '13 at 2:15

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.