HTTP for one part of the site, HTTPS for other

Question

We have a site which is HTTP, but it has an admin part. How can we secure the admin part with HTTPS?

For example, WordPress (which I know) is located at http://foo.com, but we want to have https://foo.com/wp-admin/

How to do this?

Answer 1

I'll assume you already have an SSL certificate, and have Apache (or $HTTPD) configured properly to work with SSL requests. If this is a bad assumption, let me know.

Otherwise, the quickest way to wrangle WordPress into forcing SSL for logins/admin pages would be the Admin SSL WP Plugin. Install it, activate it, et voilá.

Answer 2

A generic non-application way to force an entire directory and its subdirectories to use SSL can be acheived with Apache:

Options +FollowSymlinks
RewriteEngine On
RewriteCond %{HTTPS} off
RewriteRule (.*) https://%{HTTP_HOST}%{REQUEST_URI}

Simply put that in a the .htaccess file of the directory you wish to secure. If you put it in your root directory it will force your whole site to be secure.