Secure Admin-pages-only login without HTTPS

Question

I'm adding admin dashboard to a website that doesn't use HTTPS. For now only that (admin) section requires user authentication.

If I use encrypted + salted password and check the client IP address to allow only couple of IP-s to be logged in, will it be not secure enough?

1. Can the attackers imitate the client IP address if they intercept the original login communication?

If I have to implement HTTPS after all (for admin part only):

2. If HTTP (non secure) website uses HTTPS on some of the pages will that trigger browsers or Search engines to show unwanted warnings to users who just visit HTTP/non-admin sections? Given that the SSL certificate will be self signed.

Edit:

This is temporary measure until the whole site gets user membership feature and switch to all-https. Don't want the owner of the site pay for certificate until the project really moves forward.

Even with HTTPS on admin login page only .. if the page doesn't contain non-secure links but other pages are non-secure ... this will be the situation here.

By "secure enough" I mean not to lose the password, and not to get the site altered. It's not 'popular' site to be of hackers interests, but someone playing with some hacking tools for fun might be... All the information that admin is adding to the site going to be publicly accessible anyway, just in nice presentable way.

Answer 1

You should probably go over to HTTPS for the whole website.

If you really insist on having an insecure main site, the login form should at least be over HTTPS, otherwise an attacker can just read the admin username + password.

I don't know much about IP-address spoofing, but it seems like a very fragile system that would break for dynamic IP allocation, and I don't think relying on that will be a good idea.

IIRC, a site served over HTTPS will give warnings if subresources are loaded over HTTP, but not the other way.

The problem with self-signed certs is that the user will have to add an exception to trust the cert, so if there is a man-in-the-middle attack, they will likely think the cert needs to be re-trusted.

You're much better off just using a service like Let's Encrypt, which is free and can very easily be automated, for the entire website. You reduce a lot of risk for your users that way, both admin and non-admin.