2

The vast majority of our website contains no sensitive information, logins, forms, etc. However there are portions driven by wordpress so we are looking into getting SSL to secure these areas.

There are many articles on the internet that instruct to secure the admin areas in order to harden the wordpress site, however if the person with credentials is in an active session and browses to another portion of the site that isn't under SSL (say, to check the post they just published), wouldn't that nullify efforts to secure the session? Or am I a crazy lady who doesn't get how this works?

If it would nullify it then how does one secure the admin interface? Is HTTPS an all-or-nothing thing? We already have the contents outside of the install, so that alone helps greatly in hardening the overall site, however we don't want login pages and session cookies out there with their pants around their ankles.

Improve this question

2 Answers 2

Reset to default
2

Generally speaking, that's true. Authenticated requests (requests that contain cookies or other state information that identifies a specific user) must only be made via HTTPS for that data to remain reasonably secure.

However, in this particular instance, there may be a potential alternative, which is to set the "secure" attribute on the cookies, and treat the users as unauthenticated on non-HTTPS pages. If they don't need to be authenticated on the non-admin pages, then setting the secure flag on the cookies will insure that they aren't sent along with requests to non-admin pages that aren't protected by SSL.

So, if they cookies need to be sent with every request, then every request needs to be HTTPS. If they don't, then you're equally safe simply making sure that the cookies aren't sent except when the request is protected by SSL.

Improve this answer
2
  • There's two conflicting answers here... eeny meenie miny moe?
    – kristina childs
    Commented Mar 29, 2013 at 23:22
  • 1
    No, not conflicting, exactly. If you don't set the secure flag on the cookies, the answers are the same. It will be a problem, and you shouldn't have part of the site running under HTTP. I simply gave some additional options. :-)
    – Xander
    Commented Mar 29, 2013 at 23:25
0

If you only use HTTPS for the admin section, you'll still end up transmitting your session ID in plaintext when you browse the rest of the site. In order to keep it secure, you need to use HTTPS across the entire site.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .