Password Protect Page with PHP
I have 2 concerns with your code


Mixing PHP and HTML works, but it's difficult to follow (which means bug-prone, not scalable).  It's much better to separate your business logic from the display as much as possible.
Having a default login of admin:admin is definitely not a good idea. It's probably the first thing anyone without credentials would try.


As @fracz suggested, HTTP Basic Authentication would fit your needs well, and it's really easy to use. I would probably do something like:

&lt;?php
$LOGIN_INFORMATION = [
    'joe' =&gt; 'fkwoeiwsfrj3', 'jill' =&gt; '9ioDdoODidosD'
];

/**
 * Returns TRUE if authentication is successful. FALSE otherwise.
 * @param array $registeredLogins All acceptable logins
 * @return bool
 */
function isAuthenticated($registeredLogins){

    $authenticated = null; //make true if authentication succeeds

    //Server vars below will contain what user entered in the login prompt
    $login = isset($_SERVER['PHP_AUTH_USER'])? $_SERVER['PHP_AUTH_USER']: null;
    $pass = isset($_SERVER['PHP_AUTH_PW'])? $_SERVER['PHP_AUTH_PW']: null;

    if (!$login || !$pass):
        //required username or password is missing
        $authenticated = false;
    else:
        //username and password were provided. Are they accurate?
        $authenticated = array_key_exists($login, $registeredLogins)
                            &amp;&amp; $registeredLogins[$login] === $pass;
    endif;

    return $authenticated;
}

/**
 * Exits and causes the browser to show user a login prompt
 */
function requestCredentials(){
    header('WWW-Authenticate: Basic realm="Login to Analytics Dashboard"');
    http_response_code(401);
    die("Invalid username or password");
}

//check for authentication. Require it if missing.
if(!isAuthenticated($LOGIN_INFORMATION)) requestCredentials();
?&gt;

&lt;html&gt;
&lt;!-- your page goes here. Will only display if user is authenticated --&gt;
&lt;/html&gt;


I have simplified things a bit, so you will need to adjust it to your specific situation. With this scheme, once the user enters username and password that is accepted, the browser will keep automatically sending credentials with new requests made to the same domain. Here are the details.

A couple of important things to keep in mind: 


Whatever your security logic, if you don't use TLS (HTTPS), the client and the site will be vulnerable.  Any attacker can just read your user's verify cookie, or the username and password transmitted. The attacker can then use this info to impersonate the user and gain access. This affects both your code and what I suggested. Use TLS if you can. It's free.
Basic Authentication doesn't have a clean logout system (a way for the server to tell the browser to stop sending credentials and to delete them).  This can be worked  around easily enough though. The reference I linked above goes over this. Have a logout function that redirects the user (by setting the Location header and then exiting) to a page on the same domain with bad credentials hard-coded; eg: header("Location: http://badusername:badpass@www.example.com/logout.html");exit. Call the logout function before you echo anything to the browser and the browser will forget the old credentials, remember the bad credentials and redirect the user to logout.html.  User will be forced to enter proper credentials again if he wants access.
Because browsers will automatically attach credentials to all requests made to the domain, even the pages where you do not include password_protect.php will be queried with these credentials. This means that with this solution, TLS should be used not just on the protected pages, but on all domain's pages.