Take the 2-minute tour ×
WordPress Development Stack Exchange is a question and answer site for WordPress developers and administrators. It's 100% free, no registration required.

I want to force a secure connection on some of my pages (ones with forms), but I don't want the whole site to work with ssl (slows it down)

Is there a way to configure specific pages to require ssl?

share|improve this question
add comment

5 Answers 5

up vote 2 down vote accepted

Use the admin-ssl plugin. For stuff outside of wp, use rewriite rule in apache

share|improve this answer
2  
Admin SSL plugin url: wordpress.org/extend/plugins/admin-ssl-secure-admin –  artlung Aug 12 '10 at 0:40
    
It should be noted this plugin does not work with Wordpress 3.0+ –  Dillie-O Oct 21 '10 at 16:11
add comment

New workflow, since the Admin SSL plugin is not supported.

  • use the Plugin WP https

  • See the settings

  • If you want SSL for wp-admin, add this to the wp-config.php:

    define( 'FORCE_SSL_ADMIN', TRUE );
    
  • If you want also SSL for the log in page, add this to the wp-config.php

    define( 'FORCE_SSL_LOGIN', TRUE );
    
  • Add the follow line to the .htaccess; remove the default of WP

    <IfModule mod_rewrite.c>
       RewriteEngine On
       RewriteCond %{SERVER_PORT} !^443$
       RewriteRule (.*) https://%{HTTP_HOST}%{REQUEST_URI} [R,L]
    </IfModule>
    
  • If you set a specific page/post to SSL in front-end, then use the following plugin or set the option in the editor of the post/page; only if you have active this possibility of the plugin WP https. see also Gist 4081291 for a sample plugin

    /**
     * Plugin Name: Force SSL for specific pages
     * Description: 
     * Author:      Frank Bültge
     * Author URI:  http://bueltge.de/
     * Version:     1.0.0
     */
    
    ! defined( 'ABSPATH' ) and exit;
    
    if ( ! function_exists( 'fb_force_ssl' ) ) {
    
        add_filter( 'force_ssl' , 'fb_force_ssl', 1, 3 );
        function fb_force_ssl( $force_ssl, $id = 0, $utrl = '' ) {
            // A list of posts/page that should be SSL
            $ssl_posts = array( 22, 312 );
    
            if ( in_array( $id, $ssl_posts ) )
                $force_ssl = TRUE;
    
            return $force_ssl;
        }
    
    } // end if func exists
    
  • Without Plugin WordPress HTTPS

    add_action( 'template_redirect', 'fb_ssl_template_redirect', 1 );
    function fb_ssl_template_redirect() {
    
            if ( is_page( 123 ) && ! is_ssl() ) {
    
                if ( 0 === strpos($_SERVER['REQUEST_URI'], 'http') ) {
                    wp_redirect(preg_replace('|^http://|', 'https://', $_SERVER['REQUEST_URI']), 301 );
                    exit();
                } else {
                    wp_redirect('https://' . $_SERVER['HTTP_HOST'] . $_SERVER['REQUEST_URI'], 301 );
                    exit();
                }
            } else if ( !is_page( 123 ) && is_ssl() && !is_admin() ) {
    
                if ( 0 === strpos($_SERVER['REQUEST_URI'], 'http') ) {
                    wp_redirect(preg_replace('|^https://|', 'http://', $_SERVER['REQUEST_URI']), 301 );
                    exit();
                } else {
                    wp_redirect('http://' . $_SERVER['HTTP_HOST'] . $_SERVER['REQUEST_URI'], 301 );
                    exit();
                }
            }
    }
    

or a smaller version, but not with fallbacks, if the url is wrong

add_filter( 'pre_post_link', 'fb_set_ssl_url', 10, 3 );
function fb_set_ssl_url( $permalink, $post, $leavename ) {

    if ( 123 == $post->ID )
        return preg_replace( '|^http://|', 'https://', $permalink );

    return $permalink;
}
share|improve this answer
    
Merci; was not possible for me to formatted the code :( –  bueltge Nov 16 '12 at 10:44
    
If you're doing force ssl for admin, you don't need define( 'FORCE_SSL_LOGIN', TRUE ); –  Chirag May 23 '13 at 8:56
add comment

For WordPress version 3.0 and above, the admin-ssl plugin does not work. In order to get SSL to work, you need to take two steps:

  1. Enable the Administration Over SSL option in your wp-config.php file (see here).
  2. Install the WPSSL plugin on the site. (updated for WordPress 3.0+)
  3. On the pages you want to to run over SSL, add a meta tag called "force_ssl" and set the value to "true".

You should be all set after that.

share|improve this answer
    
WPSSL hasn't been updated in over 2 years. Are you currently using it with an updated install of WP? –  Gaia Nov 16 '12 at 13:31
1  
I have not, since I'm no longer working on that particular project. It might be time to find a newer plugin and recommend it. –  Dillie-O Nov 16 '12 at 15:35
add comment

Try the Better WP Security Plugin. Along with a bunch of helpful tweaks to secure your site, it has some settings that allow you to force ssl to the login page, or the entire back-end if you choose, and to selected pages on the front end per content via a selection box added to the visual editor. Very easy to use.

Of course, you do have to have SSL set-up on your server first, meaning you either have to install a self-signed certificate (not recommended) or pay for a certificate from a 3rd party authority and install it on your server.

share|improve this answer
    
This doesn't answer the question: "specific" pages. –  kaiser Feb 21 '13 at 9:37
add comment

Both of the plugins mentioned above seem to be outdated or at least haven't been maintained ina while. The WordPress-https plugin seems to be the best option and will force ssl on the entire site or just on certain pages.

share|improve this answer
    
this plugin is really flaky for me. i hope to find a better one. –  cwd Sep 15 '12 at 0:12
    
I used it one one site without any problems, but have not tested it extensively. I just don't trust using the plugins that haven't been updated in over a year. Also this developer seems pretty responsive to questions. –  Drai Sep 17 '12 at 15:48
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.