SELECT wp_terms.term_id, wp_terms.name, wp_terms.slug FROM wp_terms,wp_term_taxonomy WHERE wp_terms.term_id = wp_term_taxonomy.term_id AND wp_term_taxonomy.taxonomy = 'category' AND wp_terms.term_id != 1 ORDER BY name ASC

In this example, I’m getting all categories that are not “uncategorized” from WordPress.

Happy coding!

I needed a way to secure a single page. This could be an order page or a page where I want to protect user information. The problem is, even if you simply try to go to “https://mysite.com/page”, you’ll be re-directed to the http page by WordPress. Furthermore, even if you use htaccess to force the content over https, you’ll still get “partially encrypted” errors.

What is out there

There was Admin SSL, which has a 4-star rating… but did not work for me; I think the developer stopped working on it and newer versions of WP don’t work with the plugin. I also tried HTTPS for WordPress, and that didn’t work either.

Because I couldn’t find anything… I put together this hack. I guess I could make it into a plugin, but I’m lazy.

How to do it

Required knowledge/tools:

• Installation of CURL on your server
• Basic knowledge of .htaccess, and how to edit the file
• Basic php knowledge
• A working SSL certificate

1. Modify your .htaccess file

Figure out what page you wan to secure. For example, you might want to secure /contact-us. Add the following lines to your .htacccess file, before the normal wordpress lines:

<IfModule mod_rewrite.c>
RewriteEngine On
RewriteBase /
RewriteRule ^contact-us/ /secure-page.php [QSA,L]
RewriteRule ^contact-us /secure-page.php [QSA,L]
</IfModule>
# normal WordPress stuff:
<IfModule mod_rewrite.c>
RewriteEngine On
RewriteBase /
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule . /index.php [L]
</IfModule>

Here we’re checking to see if the visitor is requesting the “contact-us” page, and if so, we’re rewriting the request to a file called secure-page.php, instead of loading WordPress (step 2).

2. Rename /contact-us & modify menu

Next, you’ll need to get rid of the old /contact-us page you had, and rename it to contact-page-content – you can do this using WordPress… edit the Premalink, and set it to /contact-page-content.

You’ll need to exclude the page from your navigation, and then put an absolute link to /contact-us in your menu. I suggest the “Exclude Pages” plugin, found at http://wordpress.org/extend/plugins/exclude-pages/

2. Create secure-page.php

Create a file called secure-page.php and add it to your base directory (in the same location as your .htaccess file):

$domain = "www.mydomain.com";
if (  $_SERVER['HTTPS'] != 'on' )
{
$url="https://$domain".$_SERVER['REQUEST_URI'];
header("Location:$url");
exit;
}
$curl_handle=curl_init();
curl_setopt($curl_handle,CURLOPT_URL,"http://$domain/contact-page-content"); // assuming pretty urls are setup this way...
curl_setopt($curl_handle,CURLOPT_CONNECTTIMEOUT,2);
curl_setopt($curl_handle,CURLOPT_RETURNTRANSFER,1);
$buffer = curl_exec($curl_handle);
curl_close($curl_handle);
if (empty($buffer))
{
print "Timed Out";
}
else
{
$buffer = str_replace("src=\"http://$domain", 'src="', $buffer);
$buffer = str_replace("src='$domain", "src='", $buffer);
$buffer = str_replace("url(\"http://$domain", 'url("', $buffer);
$buffer = preg_replace ("/http:\/\/.*?(\/.*?\.css)/", "$1", $buffer);
$buffer = preg_replace ("/http:\/\/.*?(\/.*?\.js)/", "$1", $buffer);
$buffer = preg_replace ("/http:\/\/.*?(\/.*?\.xml)/", "$1", $buffer);
print $buffer;
}

OK, here’s an explanation:

You renamed /contact-us to /contact-page-content, and then excluded it from your navigation.  Note that the page still exists – you can enter /contact-page-content into your browser, and it will show the page, right?  But, you hid it from navigation, and you provided the user with a link to /contact-us.  Some people might say this solution is still not “secure”, but I could honestly care less if the user can still go to /contact-page-content… if they do, who cares?

As for what secure-page.php is doing:

The first part checks to make sure the page is served over https. If not, it forwards to the https version, and exits.

Next, we use CURL to request another page (contact-page-content).  Remember that you can still navigate to /contact-page-content, and CURL is doing just that. CURL then downloads the entire content of the page into a buffer/string.

Next, we replace all references to http assets to https… or just “/”. We do this because WordPress uses absolute URLs to assets (”http://mysite.com/image.jpg”), and we want it to be relative (”/image.jpg”).  We then echo out the buffer, and voila, your page is now secured.

Conclusion

I should turn this into a plugin, but I’m lazy and I just don’t have the time…

If you have problems just comment on this post and I’ll get back to you!