pf » Howto Require SSL for ColdFusion Administrator

A good security practice is to require SSL for ColdFusion administrator access (an even better practice is to limit access to localhost). This should only take less than five minutes on either Apache or IIS.

Require HTTPS on Apache 2

<Location /CFIDE/administrator>
	SSLRequireSSL
</Location>

Just add the above to your httpd.conf file, just make sure it appears below LoadModule ssl_module. Restart Apache, and you should get a 403 Forbidden response on http and it should work over https. I tested this on Apache 2.2, I think it should work on prior versions as well, but I have not tested them.

Require HTTPS on ISS

1. Open up IIS Manager Console
2. Right click on the CFIDE/administrator/ directory
3. Click Directory Security Tab
4. Under Secure Communications click Edit
5. Enable Require secure channel (SSL)