Do I need to secure my website?

If I want to SSL secure a website, do I need to change anything on the existing code?

• Answer:

  Normally no. You'll need to buy an SSL certificate, and add it to your server configuration, plus whatever schemes you want for redirects between non-ssl and ssl (i prefer just forcing all-ssl). Now if you have hardcoded internal site links to http:// in your server code, html, css or javascript, you will have some cleanup work to do, as you want all these to point to https:// instead. If they are all relative (as they should be), you should be ok. Some people prefer (don't ask me why) to serve parts of their site (login, creditcard form)  over ssl and other parts not. This takes a bit more hassle, has real chances of you shooting yourself in the foot security wise, and serves no real purpose as far as i can see.