We recently installed SSL successfully onto our site. It is using a single directory for SSL and non SSL.

I have a couple of questions and problems and was hoping for some help.

Firstly which pages should be secure? I have so far planned on making the login and register pages secure. Should I also make the page that submits an order (php email) to the customer and company secure? What about updating the customer details.....

Secondly I am having problems with the first page I have tried to make secure, the login page.

I want is so that a customer goes to the http site, clicks login, is directed to the https page, they login then are directed back to the http site. This way in IE they will get a message saying they are going to a secure page, then login, then another message saying they are going to a non secure page.... However when I do a redirect it just hangs.

The other option is to have the whole site secure, but I have heard this slows down the site, plus it means all my image paths etc have to be changed to secure so I dont get the 'this page secure and non secure items' message.... and I just think the first option is the better way.

I have seen a website that does what I am after (just secures the login then puts them back into a non SSL site) but I don't know what they did (www.trademe.co.nz).

This is my normal redirect script that makes it hang:

<META HTTP-EQUIV="refresh" content="4" URL="<?php echo $securepath.'index.php'; ?>">

With the variable containing the entire https://www.domain.com/ path.


So to sum up, couple of questions:

1) Should i do SSL for any other pages besides login/register.... should I do it when an order is sent, a customer details are updated etc

2) How do I have a secure login page that redirects to a non secure page without hanging

I haven't included much code because there wasn't much outside the normal stuff but let me know if you want to see anything else...


Thank you.