Security - Login system
Here's my 2 cents as Java "developer" with a little experience in c# and vba.

Your security here largely depends on whether you send the password and username in clear text or encrypted. You should force HTTPS protocol for access to the page. 

You might also want to show errors if the login is invalid:

$valid = true;
if(!isset($_POST['username']) || empty($_POST['username'])){
   $errors .= "Please enter a username.&lt;br&gt;"
   $valid = false;
}
if(!isset($_POST['password']) || empty($_POST['password'])){
   $errors .= "Please enter a pasword.&lt;br&gt;"
   $valid = false;
}
if($valid){
  //check for username and password compliance
}


Also it would definitely be better to have the logout be handled in a different file than the login