[Keysailor]

I hope someone who really knows about this can also help. I have a vbulletin 4.1.1 site that I'd like to be able to encrypt (such as when on a public network). But I don't want to lock into having everything https, that negatively affects performance.

I have figured out a partial solution:

• in AdminCP under Options, Site Name/URL/Contact Details, there is an option to say No to the option "Always use Forum URL as Base Path"...
• Also under "Forum URL", if you make that https, and also the "Homepage URL" (which only affects the footer link)...

You end up with the site being accessible under either http or https. Navigating within your forum is catch-as-catch can - some links will take you to an https page, some will revert to http. There doesn't seem to be much rhyme or reason to how that works. My guess is you'd have to go through every template and look for links, then switch them to relative. Even that might not take care of every element in the forum.

And in https you'll get annoying warnings from your browser since encrypted pages will have unencrypted elements in them (all of them, I think).

But by doing this, at least you'll be able to access the site and log in using https or http.

Imo using https on a forum is overkill unless you are on a public WLAN (say Starbucks or Panera Bread) that's capable of being snooped.

And I think the primary security issue is the username password. If you start out with https, that will be encrypted. So even if you then go unencrypted after login for the rest of your session, your password (I think) is secure. Only the content you are reading could be snooped. Btw, I am NOT stating facts, just an educated guess. Anyone out there want to confirm this?