Back-End on SSL Connection Only

[globi]

Hallo!

I'd like to force SSL (port 443) for the back-end (./processwire/) and prevent the users from loging to the back-end using non-encrypted connection.
What seems to be the best way to achieve it?


Best regards,
Mick

[Pete]

Does it have to just be the backend? I don't think there's any harm in setting the whole site to SSL if you want to be on the safe side.

[Pete]

If your admin is located at /processwire/ it looks like the easiest thing to do is edit your .htaccess file and add this solution to it  after RewriteEngine On:
 http://stackoverflow.com/questions/9642877/redirect-only-one-folder-to-https-all-others-to-http

Remember to leave the RewriteEngine On line off the example (don't want it in the .htaccess file twice) and change secure to processwire from the example.

Should work but I've not tested it.

[Soma]

Templates -> Filters -> Show System Templates : look for "admin" template. Edit and go to -> "URLs" and look for https etc.

[Pete]

Or that Soma, yes

[globi]

Thanks, Soma!

[Gazley]

A great answer from Soma. However, here's a further question around this topic ...

I quite often take a backup of the server DB and install it locally when I want to work on the site. Generally, the data is more up to date on the server than on my local copy.

If I install the backup from the server, I have no SSL certificate locally and I cannot get into the Admin section.

Any suggestions as to how to get around this?

Thanks.

[cstevensjr]

One option is to install a self-signed SSL Certificate on your local machine.   There are numerous instructions on how to do this on the Internet.

I have referenced one that applies to Windows users to get you started.

http://www.howtogeek.com/107415/it-how-to-create-a-self-signed-security-ssl-certificate-and-deploy-it-to-client-machines/

[Gazley]

Thank you for a great suggestion!