Forced SSL - possible ?

[DogTags]

Even if you have all your configure.php settings turned on for SSL, it seems that the user can still switch a page to non-secure if they put their cursor into the address bar, delete the "s" in https, and then refresh the page.

Is there a way to force an SSL connection even if an insecure page is called for any reason?

Perhaps something in the .htaccess file maybe? Like, "If this is not a secure address, convert it to a secure address"

Many thanks :)

[Ajeh]

They only hurt themselves ... what exactly are the concerns here?

[DogTags]

Was just thinking that if SSL could be forced that it would add a little security for the site owner, too.

[Ajeh]

If you set the code to secure all around it will run that way ...

If customers change the URL to not be secure it will hit for the one link ... but then switch again on next click ...

I am not sure that customers would gain anything doing this ...

As to a full secure site you run the risk of a much slower site for pages that do not need to be secure ...

[DrByte]

Actually, if a page is only COLLECTING information, then it doesn't matter if they override the URL and view the page in non-SSL mode, since clicking the submit button will still transmit via SSL (of course, this assumes your site normally operates in SSL modes).
However, if they choose to display their account information in a non-SSL manner, it's only them that is being injured by sending their personal information for display.

[DogTags]

Thanks, Ajey and Dr. :-)