2

I'm running a WordPress site on a shared Apache server on Dreamhost. I already have define('FORCE_SSL_ADMIN', true); set (and working) in my wp-config.php so that SSL is used for the /wp-admin/ directory.

Can you point me to a .htaccess set of rules that will still maintain /wp-admin/ over https, but redirect any other directory/URL to use http? All help is appreciated. Thanks.

Improve this question
  • 1
    Why not just use https for everything? As long as you're setting it up, you might as well take full advantage. Unless, I suppose, you're using a self-signed cert, in which case it wouldn't be ideal. – EEAA May 4 '11 at 13:33
  • I use a cdn, and that is currently only set up for http. Plus, Google results are pointing to http and https. I would rather just have http. – Kevin Worthington May 4 '11 at 22:29
  • @ErikA There is a huge performance risk to deal with when 'just' using HTTPS. Every page which is requested needs to go through the 3 way handshake and every page that is serviced also comes with the overhead of encryption. – emtunc May 19 '11 at 21:34
  • @emtunc - yes, there is a bit of overhead, but surely not a huge performance hit. If your server is that close to pegging its CPU that it cannot handle serving via SSL, then you have other problems to solve. – EEAA May 19 '11 at 21:58
5
RewriteCond %{REQUEST_URI} !^/wp-admin/
RewriteCond %{HTTPS} on
RewriteCond %{HTTP_HOST} (.*)
RewriteRule ^/(.*) http://%1/$1 [L,R,QSA]

Note that if your admin interface loads images, CSS, JS, etc. out of a directory other than /wp-admin/ (which by default it does), this will probably make a warning appear on your browser (and will likely compromise the security you were trying to gain). You can add something like:

RewriteCond %{REQUEST_URI} !\.(js|css|jpg|gif|png)$

to resolve that, just keep adding extensions until you've got everything covered.

Improve this answer
  • I tried the above. When I visit the root domain via https it doesn't redirect to http. Any ideas? – Kevin Worthington May 4 '11 at 22:28
  • 2
    In a .htaccess, drop the leading / from the RewriteRule. – BMDan May 5 '11 at 2:46
  • Yes +1! +1 for your answer and the checkmark! Thank you! – Kevin Worthington May 5 '11 at 14:23
  • A .js is coming over http, rather than https. I have: RewriteCond %{REQUEST_URI} !\.(js|css|jpg|gif|png)$ right after the first line that has the /wp-admin/. Is that correct? – Kevin Worthington May 5 '11 at 15:00
  • At first glance at least, that looks like it should work. Is it? Note that it won't rewrite broken HTML; if the HTML tells the browser to fetch the JS via HTTP, that will still happen. This is just to prevent errors from appearing when the HTML is correct. – BMDan May 5 '11 at 21:54

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.