It's obviously going to be easiest if you do it from the beginning, but even retrofitting won't be a huge issue. It's probably also easier if you secure your e

It's obviously going to be easiest if you do it from the beginning, but even retrofitting won't be a huge issue. It's probably also easier if you secure your entire site rather than piecemeal (like just for logins). I actually did it last night, from yum install httpd to (self-signed) SSL in less than 15 minutes. There are some webapp considerations, but they are negligible when compared to other security efforts like XSS diligence.