Force SSL only on certain pages with PHP - php

Question

I have found a solution for setting one page on my WordPress site to use https though I am trying to apply the ssl to two pages instead of one. I have tried various if or statements, but can't seem to get the syntax correct.
Below is my if statement that works perfectly on one page:
if (!empty($_SERVER['HTTPS']) && !empty($_SERVER['REQUEST_URI']))
{
if ($_SERVER['HTTPS'] == 'on' && $_SERVER['REQUEST_URI'] != '/bill-pay/')
{
header("Location:http://example.com{$_SERVER['REQUEST_URI']}", 301);
exit;
}
elseif ($_SERVER['HTTPS'] != 'on' && $_SERVER['REQUEST_URI'] == '/bill-pay/')
{
header("Location: https://example.com{$_SERVER['REQUEST_URI']}", 301);
exit;
}
}
For the sake of clarity, I have only added my version that works for one page.

Answer 1

Keep in mind that only securing part of the site effectively means almost no security at all. Via MITM or other vulnerabilities an attacker can easily rewrite the links to the secure pages to outside pages under control of the attacker.
Remember, SSL is not only about a secure connection but also about proving who you (=your site) really are. Please, do secure your whole site, run it through SSL Labs, follow its recommendations. It's better for everyone, especially your customers.

Answer 2

Would have thought a straight-forward...
if (!empty($_SERVER['HTTPS']) && !empty($_SERVER['REQUEST_URI']))
{
if ($_SERVER['HTTPS'] == 'on' && !($_SERVER['REQUEST_URI'] == '/bill-pay/' || $_SERVER['REQUEST_URI'] == '/other-page/'))
{
header("Location:http://example.com{$_SERVER['REQUEST_URI']}", 301);
exit;
}
elseif ($_SERVER['HTTPS'] != 'on' && ($_SERVER['REQUEST_URI'] == '/bill-pay/' || $_SERVER['REQUEST_URI'] == '/other-page/'))
{
header("Location: https://example.com{$_SERVER['REQUEST_URI']}", 301);
exit;
}
}
... should do the trick
Edit
This code might be more appropriate, given the comments:
if (isset($_SERVER['REQUEST_URI']) && ($_SERVER['REQUEST_URI'] == '/bill-pay/' || $_SERVER['REQUEST_URI'] == '/other-page/'))
{
if (!isset($_SERVER['HTTPS']) || empty($_SERVER['HTTPS']))
{
header("Location: https://example.com{$_SERVER['REQUEST_URI']}", 301);
exit;
}
}
else
{
if (isset($_SERVER['HTTPS']) && !empty($_SERVER['HTTPS']))
{
header("Location: http://example.com{$_SERVER['REQUEST_URI']}", 301);
exit;
}
}
Remember empty() resolves to false if the value is not set ;)