I'm adding admin dashboard to a website that doesn't use HTTPS. For now only that (admin) section requires user authentication.
If I use encrypted + salted password and check the client IP address to allow only couple of IP-s to be logged in, will it be not secure enough?
- Can the attackers imitate the client IP address if they intercept the original login communication?
If I have to implement HTTPS after all (for admin part only):
- If HTTP (non secure) website uses HTTPS on some of the pages will that trigger browsers or Search engines to show unwanted warnings to users who just visit HTTP/non-admin sections? Given that the SSL certificate will be self signed.
This is temporary measure until the whole site gets user membership feature and switch to all-https. Don't want the owner of the site pay for certificate until the project really moves forward.
Even with HTTPS on admin login page only .. if the page doesn't contain non-secure links but other pages are non-secure ... this will be the situation here.
By "secure enough" I mean not to lose the password, and not to get the site altered. It's not 'popular' site to be of hackers interests, but someone playing with some hacking tools for fun might be... All the information that admin is adding to the site going to be publicly accessible anyway, just in nice presentable way.