Support

Hello Dave,

What you describe (HTTS "sticking" after visiting a page over SSL) is how Joomla! works. It has nothing to do with Admin Tools and it can't be worked around by Admin Tools. The only thing you can do is set all menu items to forcibly NOT use SSL (it's in the menu options) except those menu items you do want them to be viewed over SSL. Mind you, this is not a holistic approach. It is still possible that you end up viewing pages without an Itemid (not belonging to a menu item), therefore HTTPS would "stick" for them as well.

Again, please note that this Joomla! behaviour can not be worked around effectively in any way, including .htaccess rules and/or PHP code in an extension. At best you can achieve a half-solution.

In any case, I would propose putting all of your pages through HTTPS unless you have a very good reason not to. HTTPS increases the server load by less than 1% (which is peanuts). Serving login cookies over plain HTTP is insecure as there is a strong chance than someone can steal the cookie and spoof the logged in user. By making the site HTTPS only you effectively work around this kind of attack possibility. It is exactly why I have made this site HTTPS-only. The only drawbacks I can think to an HTTPS-only site is that some third party services, like Facebook and Twitter, may require special configuration in order not to throw errors. Moreover, some services like Disqus do not yet offer an HTTPS-ready implementation. That's the only show-stopper I can think which could lead someone who has already invested in an SSL certificate not using it site-wide.

Oops! I was typing my reply before receiving your last post :s You can do a mass force-HTTPS in the following way:
- In Joomla! Global Configuration set Force SSL to Entire Site
- Make sure all menus have Secure set to Ignore in their Metadata Options area
- In .htaccess Maker, "Custom .htaccess rules at the top of the file" add this:

RewriteCond %{HTTPS} ^off$ [NC,OR]
RewriteCond %{SERVER_PORT} !^443$
RewriteRule .* https://www.example.com/$1 [R=301,L]

where www.example.com must be replaced with your site's domain name.

You're welcome, Dave :)