diff --git a/encoder/header.php b/encoder/header.php
index a914a22..19aea3c 100755
--- a/encoder/header.php
+++ b/encoder/header.php
@@ -1,4 +1,7 @@
-<?php include 'static.php'; ?>
+<?php 
+require 'require_login.php';
+include 'static.php';
+?>
 <!doctype html>
 <html lang="en">
 
diff --git a/encoder/login.php b/encoder/login.php
index aacaf49..12fde92 100644
--- a/encoder/login.php
+++ b/encoder/login.php
@@ -1,6 +1,13 @@
 <?php
+header('Cache-Control: no-store, no-cache, must-revalidate, max-age=0');
+header('Pragma: no-cache');
+header('Expires: 0');
 session_start();
-
+    
+if (!empty($_SESSION['user'])) {
+    header('Location: /index.php', true, 302);
+    exit;
+}
 /* ---------- CONFIG ---------- */
 $usersFile    = '/var/www/users.json';
 $attemptsFile = '/var/www/attempts.json';
@@ -72,7 +79,7 @@ if ($_SERVER['REQUEST_METHOD'] === 'POST') {
         unset($attempts[$ip]);
         save_json($attemptsFile, $attempts);
         $_SESSION['user'] = $username;
-        header('Location: dashboard.php');
+        header('Location: index.php');
         exit;
     }
 
diff --git a/encoder/logout.php b/encoder/logout.php
new file mode 100644
index 0000000..9174e49
--- /dev/null
+++ b/encoder/logout.php
@@ -0,0 +1,22 @@
+<?php
+session_start();
+
+$_SESSION = [];
+
+if (ini_get('session.use_cookies')) {
+    $p = session_get_cookie_params();
+    setcookie(
+        session_name(),
+        '',
+        time() - 42000,
+        $p['path'],
+        $p['domain'],
+        $p['secure'],
+        $p['httponly']
+    );
+}
+
+session_destroy();
+
+header('Location: /login.php');
+exit;
diff --git a/encoder/require_login.php b/encoder/require_login.php
new file mode 100644
index 0000000..ad47b13
--- /dev/null
+++ b/encoder/require_login.php
@@ -0,0 +1,21 @@
+<?php
+// auth/require_login.php
+
+declare(strict_types=1);
+session_start();
+
+/* ---------- SECURITY HEADERS (optional but recommended) ---------- */
+header('X-Frame-Options: DENY');
+header('X-Content-Type-Options: nosniff');
+header('Referrer-Policy: strict-origin-when-cross-origin');
+
+/* ---------- LOGIN CHECK ---------- */
+if (empty($_SESSION['user'])) {
+
+    // Prevent cache of protected pages
+    header('Cache-Control: no-store, no-cache, must-revalidate, max-age=0');
+    header('Pragma: no-cache');
+
+    header('Location: /login.php', true, 302);
+    exit;
+}
diff --git a/users.json b/users.json
index 6742f61..67ad16b 100644
--- a/users.json
+++ b/users.json
@@ -1,5 +1,5 @@
 {
   "shreebhattji": {
-    "password": "$2y$10$eImiTXuWVxfM37uY4JANjQ=="
+    "password": "$2y$10$BInKRv9mhK69VfYKIi4WVegAs9VWtLhfdZH4YoDk5aE2U61cmyT2a"
   }
 }
