I have a site at mydomain.com. Users can sign up there to create a simple little site of their own that gets automatically created and can then be found at mydomain.com/name-user-chose
There is an admin section of the site that users can log in to to create and manage their pages.
I want to enable SSL on the site for the log in functionality and because the back end admin section uses Stripe to handle payments. I'm wondering what the best way to handle SSL is in this type of set up. All of the user created pages won't need SSL, nor will the homepage, just the admin section.
That leads me to think that perhaps the best way to handle it is set up a subdomain, perhaps admin.mydomain.com and only use SSL on that subdomain. Handle all of the user login throught that subdomain as well. And leave mydomain.com and all of the user pages (for instance: mydomain.com/this-is-an-example) as regualar http pages and not SSL.
Would that represent best practices? I know just enough that I know how to implement everything above, but I don't know enough to know whether or not it would be the best way to do things.