Possible improvements on admin login area? I've created an admin login area for an application I am planning to code, and I've used the following login.html page to let the user type in his data (I left out parts like "id", "placeholder" etc. to make it shorter):

&lt;form method="post" action="login.php"&gt;
  &lt;input type="text" name="username"&gt;
  &lt;input type="password" name="password"&gt;
  &lt;input type="submit" value="Login" name="submit"&gt;
&lt;/form&gt;


The form is processed as is, no JavaScript interfering here.  The login.php then looks like this:

&lt;?php
  if (isset($_POST['password']) &amp;&amp; isset($_POST['userName'])) {
    if ($_POST['password'] == "myPassword" &amp;&amp; $_POST['userName'] == "myUsername") {
      if (!session_id()) {
        session_start();
        $_SESSION['logon'] = true;
        header('Location: admin_area.php');
        die();
      }
    } else if ($_POST["password"] == "" || $_POST["userName"] == "") {
      echo "Please enter both a username and a password! You are sent back in 3 seconds";
      echo "&lt;meta http-equiv='refresh' content='3;url=login.html'&gt;";
    } else {
      echo "Wrong username and/or password! You are set back in 3 seconds";
      echo "&lt;meta http-equiv='refresh' content='3;url=login.html'&gt;";
    }
  } else {
    echo "This is a restricted area, you have to log in!";
    echo "&lt;meta http-equiv='refresh' content='3;url=login.html'&gt;";
  }
?&gt;


The admin_area.php file, which the user is then being redirected to, has the following short placeholder code:

&lt;?php
  if (!session_id()) session_start();
  if (!$_SESSION['logon']) { 
    echo "This is a restricted area, you have to log in!";
    echo "&lt;meta http-equiv='refresh' content='3;url=login.html'&gt;";
  } else {
    echo "&lt;script src='//ajax.googleapis.com/ajax/libs/jquery/2.0.3/jquery.min.js'&gt;&lt;/script&gt;";
    echo "&lt;script type='text/javascript' src='session_destroy.js'&gt;&lt;/script&gt;";
    echo "Hello World!";
    echo "&lt;br&gt;";
    echo "&lt;input type='button' id='exit_button' value='Exit' onclick='window.open(\"\", \"_self\", \"\"); window.close();'&gt;";
  }
?&gt;


The essential part of the session_destroy.js file on this page contains this code snippet:

$(window).on("beforeunload", function() {
  $.get("session_destroy.php");
  return "You have left the page. Your session has been terminated.";
});


And finally, the session_destroy.php, which should terminate all session data, contains the following lines (taken from the PHP manual):

&lt;?php
  if (!session_id()) session_start();
  if (!$_SESSION['logon']) { 
    echo "This is a restricted area, you have to log in!";
    echo "&lt;meta http-equiv='refresh' content='3;url=login.html'&gt;";
  } else {
    $_SESSION = array();
    if (ini_get("session.use_cookies")) {
      $params = session_get_cookie_params();
      setcookie(session_name(), '', time() - 42000,
        $params["path"], $params["domain"],
        $params["secure"], $params["httponly"]
      );
    }
    session_destroy();
    header('Location: login.html');
  }
?&gt;


Now this "construct" seems to be working just fine.  I am wondering if there are some improvements on these lines, as I have researched everything myself and I am not sure how "secure" and correct these methods might be.

I am thinking of possible security improvements to the form-processing and session-handling / destroying. Are there any areas in which I should do more research?
Tha major security issue I see is that you do not have any limiting or logs for wrong/success attempts. One can use automated brute force attacks trying all day/night long to guess your username and password. If lack of success, at least you might have your app slowed down, because of the billion requests.

As you requested, I tried to add some code examples around my suggestion:

&lt;?php

//the db interaction is pseudo code, because it depends on the API you are using
/**
 * 
 * @param int $success : 0 for fail, 1 for success
 */
function logAttempt($success) {
    $user = $db-&gt;escape($_POST['userName']);
    $pass = $db-&gt;escape($_POST['password']);
    $session_id = session_id();
    if (!in_array($success, array(0, 1))) {
        return false;
    }
    $db-&gt;query("INSERT INTO `log_attempts` 
                    (`user`, `pass`, `ip`, `session_id`, `success`, `tried_on`)
                VALUES
                    ('$user', '$pass', '{$_SERVER['REMOTE_ADDR']}', '$session_id', '$success', NOW());
            ");
    return $db-&gt;affected_rows &gt; 0;
}

function isAttemptsLimitExceeded() {
    $max_attempts = 5;
    $session_id = session_id();
    $res = $db-&gt;query("SELECT 
                            COUNT(*) AS cnt
                        FROM 
                            `log_attempts`
                        WHERE
                            `session_id` = '$session_id' AND
                            `tried_on` &gt; DATE_SUB(NOW(), INTERVAL 24 HOUR) AND
                            `success` = '0';
                    ");
    $row = $db-&gt;fetch($res);
    if ($row['cnt'] &gt;= $max_attempts) {
        return true;
    }
    return false;
}

function banFailedLogins() {
    if(isAttemptsLimitExceeded()) {
        $db-&gt;query("INSERT INTO `blacklist`
                        (`ip`, `banned_on`)
                    VALUES
                        ('{$_SERVER['REMOTE_ADDR']}', NOW()");
    }
    return $db-&gt;affected_rows &gt; 0;
}

function clearBans() {
    $db-&gt;query("DELETE from `blacklist` WHERE `ip` = '{$_SERVER['REMOTE_ADDR']}';");
    return $db-&gt;affected_rows &gt; 0;
}

//check for expired bans?
function canAcess() {
    $ban_expire = 24; // hours
    $res = $db-&gt;query("SELECT 
                            COUNT(*) AS cnt 
                        FROM 
                            `blacklist` 
                        WHERE 
                            `ip` = '{$_SERVER['REMOTE_ADDR']}' AND
                            `banned_on` &gt; DATE_SUB(NOW(), INTERVAL $ban_expire HOUR);
                        ");
    $row = $db-&gt;fetch($res);
    if ($row['cnt'] &gt; 0) {
        return false;
    }
    else {
        clearBans();
        return true;
    }
}

if (!canAcess()) {
    die("You are banned for failed login attempts");
}
  if (isset($_POST['password']) &amp;&amp; isset($_POST['userName'])) {
    if ($_POST['password'] == "myPassword" &amp;&amp; $_POST['userName'] == "myUsername") {
      if (!session_id()) {
        session_start();
        $_SESSION['logon'] = true;
        logAttempt(1); //log successfull attempt
        header('Location: admin_area.php');
        die();
      }
    } else if ($_POST["password"] == "" || $_POST["userName"] == "") {
      echo "Please enter both a username and a password! You are sent back in 3 seconds";
      logAttempt(0); //log failed attempt
      banFailedLogins();
      echo "&lt;meta http-equiv='refresh' content='3;url=login.html'&gt;";
    } else {
      echo "Wrong username and/or password! You are set back in 3 seconds";
      logAttempt(0); //log failed attempt
      banFailedLogins();
      echo "&lt;meta http-equiv='refresh' content='3;url=login.html'&gt;";
    }
  } else {
    echo "This is a restricted area, you have to log in!";
    echo "&lt;meta http-equiv='refresh' content='3;url=login.html'&gt;";
  }

?&gt;