Simple single-file PHP login system This is something that I initially came up with to protect a bunch of scripts on my personal webserver, but am now planning on using with a few public projects too.

login.php:

&lt;?php
session_start();

//log out if ?logout=true
if($_GET["logout"]){
    $_SESSION["loggedIn"]=false;
    session_destroy();
    header('Location: '. $_SERVER['SCRIPT_NAME']);
    exit();
}

$password = '8f434346648f6b96df89dda901c5176b10a6d83961dd3c1ac88b59b2dc327aa4';

if(empty($_SESSION["loggedIn"])){
    if(isset($_POST["password"])){
        if(hash('sha256', $_POST['password'])===$password){
                session_regenerate_id(true);
                $_SESSION["loggedIn"]=true;
        } else{
            echo "Incorrect password! &lt;br&gt;";
        }   
    }
}

if($_SESSION["loggedIn"] == true){
print '
    You are logged in!&lt;br&gt;
    &lt;a href="?logout=true"&gt;Logout&lt;/a&gt;
    &lt;!-- HTML page goes here--&gt;
';
} else{
print ' &lt;h3&gt;Login&lt;/h3&gt;
      &lt;form action="#" method="post"&gt;
        Password: &lt;input type="password" name="password"&gt;&lt;br&gt;
      &lt;input type="submit" value="Login!" /&gt;
    &lt;/form&gt;
';
}
?&gt;


For other files which should only be accessible if the user is logged in:

OtherFiles.php:

&lt;?php
session_start();
if($_SESSION["loggedIn"]==false){
    session_destroy();
    header('Location: login.php');
    exit();
} else {
    //stuff goes here
}


Yes, I know, sha-256 hashes aren't recommended for password storage, but that's only for testing, when deployed it'll be using proper salting for password storage. What I need feedback on is the login script itself.
Perhaps use some strategies to counter CSRF as well. Take a look at this comprehensive guide: https://www.owasp.org/index.php/Cross-Site_Request_Forgery_(CSRF)_Prevention_Cheat_Sheet