encrypt admin password

[DrByte]

You can't encrypt it browser-side before sending. You'll need SSL to do that.

If you wanted to custom-code a challenge-response system, you're welcome to do so. The /admin/login.php file is where you'd do it.

Some folks double protect the folder via .htaccess. However, this again is not encrypted unless the area is secured via SSL.

At $18 I'm not sure why SSL would be much of a problem ... esp since most hosts offer shared SSL for no cost. Shared SSL doesn't make the URL pretty, but as you said, it's functionality you're after.

[mltsy]

Perhaps a shared SSL certificate would be the way to go. Although, for me it would be easier to set up htaccess.

.htaccess would be encrypted if it was using digest authentication with a browser that supports it (which the newest Firefox and IE both do). It wouldn't encrypt the information being sent back and forth, but at least the authentication would be encrypted (not the admin login, but that login would just be a red herring then). I'm just wondering if adding that to the admin directory would be enough to secure the store management side. It seems to me that it might... but is there anything malicious that could be done using HTTP to access files that are anywhere other than inside the admin directory?

[Kim]

You are going to be running an ecommerce site and the Admin is not your only worry - you need SSL, either shared or dedicated for the CATALOG. You customers will be inputting their private information in during the checkout and it should be protected.