The vast majority of our website contains no sensitive information, logins, forms, etc. However there are portions driven by wordpress so we are looking into getting SSL to secure these areas.
There are many articles on the internet that instruct to secure the admin areas in order to harden the wordpress site, however if the person with credentials is in an active session and browses to another portion of the site that isn't under SSL (say, to check the post they just published), wouldn't that nullify efforts to secure the session? Or am I a crazy lady who doesn't get how this works?
If it would nullify it then how does one secure the admin interface? Is HTTPS an all-or-nothing thing? We already have the contents outside of the install, so that alone helps greatly in hardening the overall site, however we don't want login pages and session cookies out there with their pants around their ankles.