I use WordPress to host a blog, so I need to log in to use the Admin Panel. Since I do not have and SSL certificate , is there any way to make the login secure without one?

Note: I don't want to use Let's Encrypt because I don't agree with their privacy policy.

closed as off-topic by kraftner, cybmeta, Max Yudin, Robert hue, cjbj Jul 17 '17 at 11:43

This question appears to be off-topic. The users who voted to close gave this specific reason:

If this question can be reworded to fit the rules in the help center, please edit the question.

  • while I understand your client side concern of not sending text passwords (that is, to protect the password itself rather than site access), https is far simpler to implement than it used to be. Do look into something like letsencrypt.org and get your site over to https if security is a concern. – hwl Jul 11 '17 at 23:35
  • I don't like Lets Encrypt's privacy policy – NerdOfLinux Jul 12 '17 at 0:05

Current browser versions will get 'mad' (show a warning message) if you try to mix HTTP and HTTPS content on the same page. And most current browsers (and future versions, as announced) will show a warning message on a login page if the page is not SSL.

The only possible way to have a login field SSL'd is to put it in an iFrame that has SSL. And most browsers will complain about that (because you are mixing SSL and non-SSL content on a page).

Besides, if you are going to SSL a login field, you'll need an SSL certificate installed on your site. Since you have to do that, you might as well SSL the entire site.

There are several plugins that will SSL your site, ensuring that you don't have mixed content on a page. I've used the Really Simple SSL plugin https://wordpress.org/plugins/really-simple-ssl/ .

Get an SSL certificate from your hosting place. Install it, then use a plugin to get it working. The Really Simple SSL plugin works quite well and easily to do this.

  • My site is hosted on a VPS from Vultr. – NerdOfLinux Jul 12 '17 at 3:06
  • 1
    A 'VPS' (assume Virtual Private Server) does not equal SSL. Ask your hosting place (Vultr ?) to add an SSL certificiate to your site. Then use the Really Simple SSL plugin to enable it on your site. Boom! Your login data (from the form) will be encrypted in transit to your site. And visitor's browsers will not see the security warning on the login page. – Rick Hellewell Jul 12 '17 at 3:15
  • I meant that I can not get an SSL certificate from my hosting place. – NerdOfLinux Jul 12 '17 at 3:21
  • 1
    Then, you will need to find a hosting place that will issue an SSL. Or use the Let's Encrypt (if that is allowed by your host) to provide the SSL. You can't encrypt part of a form (like a login form) without an SSL. "Encrypt" means to encrypt the POST variables (variables sent by your form submit action) in transit between the visitor's computer and your site (hosting server). – Rick Hellewell Jul 12 '17 at 3:24
up vote 0 down vote accepted

After much research, I figured out that there is no way to do it. I ended up choosing to use Cloudflare, as they proved free HTTPS along with other useful features.

Not the answer you're looking for? Browse other questions tagged or ask your own question.