I'm using a similar SSL setup on my site (SSL for WP Admin pages, but non-SSL for the front-end pages, except for my s2Member checkout page and the Login Welcome Page).
A Quick Primer on How Browsers Handle Links (SSL/non-SSL)
One thing to keep in mind about how web pages and links work: When a page is loaded with SSL, the base URL starts with https://example.com. Now any relative links on that web page will automatically use that base URL.
So, if you have a link on the page like this: <a href="/contact/">Contact</a>, your web browser will take whatever base URL is in your browser (e.g., https://example.com) and prepend that to the relative links in the HTML of the page to create a complete link (in this case, https://example.com/contact/).
Now, if the link on that page was written as <a href="http://example.com/contact/">Contact</a>, then even if you accessed the page with https://example.com, that link would still be set to http://example.com/contact/.
With me so far?
Now here's the thing about relative links: they're used everywhere. It's actually considered best-practice to use relative links. If you decide to move your site to another domain name, it would be a royal pain if you had hard-coded all the links instead of using relative links.
So, you'll find relative links everywhere. This means that without doing some crazy rewriting of the HTML to force all links to be full links using non-SSL, you're not going to be able to prevent users from accessing SSL links.
If you use SSL on the Membership Options Page, for example, and a user then clicks on the About Page link, he's going to end up at the SSL version of the About page. As I explained above, the only way to avoid this is to make sure all your links contain the full URL instead of using relative URLs (WordPress themes use the relative links by default.)
Once my users login, they end up at an SSL page and unless they click on a hard-coded link somewhere, they end up browsing my site using SSL (it's good practice to protect login sessions using SSL anyway).
However, non-logged in users typically never see an SSL page because the home page and all my other pages do not force SSL. Only when they go to my checkout page or login do they hit an SSL URL.
Redirecting to non-SSL home page after checkout
Regarding what happens after a user makes a payment: With s2Member Pro, you can add the success= shortcode attribute to your buttons to control where s2Member sends the user after checkout:
success="" Success Return URL ( optional ). s2Member handles this automatically for you. However, if you would prefer to take control over the landing page after checkout ( i.e. your own custom Thank-You Page ), you can. If supplied, this must be a full URL, starting with http://. Note, s2Member will NOT use this value if an existing account holder is being modified. s2Member handles account updates ( i.e. billing modification ) in a more dynamic way. Your Success Return URL is only applied to (new) Customers.
You can use the success= attribute to send people directly to the non-SSL version of your homepage.
Does that make sense?
I am really excited about this plugin. It is so well documented and easy to setup.
Thanks for the kudos!Statistics: Posted by Raam Dev — January 4th, 2012, 7:20 pm
]]>