WordPress – HTTPS for /wp-admin/ and HTTP for everything else

.htaccessapache-2.2httphttpsWordpress

I'm running a WordPress site on a shared Apache server on Dreamhost. I already have define('FORCE_SSL_ADMIN', true); set (and working) in my wp-config.php so that SSL is used for the /wp-admin/ directory.

Can you point me to a .htaccess set of rules that will still maintain /wp-admin/ over https, but redirect any other directory/URL to use http? All help is appreciated. Thanks.

Best Answer

RewriteCond %{REQUEST_URI} !^/wp-admin/
RewriteCond %{HTTPS} on
RewriteCond %{HTTP_HOST} (.*)
RewriteRule ^/(.*) http://%1/$1 [L,R,QSA]

Note that if your admin interface loads images, CSS, JS, etc. out of a directory other than /wp-admin/ (which by default it does), this will probably make a warning appear on your browser (and will likely compromise the security you were trying to gain). You can add something like:

RewriteCond %{REQUEST_URI} !\.(js|css|jpg|gif|png)$

to resolve that, just keep adding extensions until you've got everything covered.

Related Topic