Can you make the session automatically logout when the browser closes?
So, for example, try logging in, and then wait about 1 hour (or even less, depends) and then try visiting the protected page again. You will see that you have to login again to view the page. Or try logging in with one browser on your computer, and try visiting the protected page from another browser. You will see that you cannot do so.
This is how the majority of websites design their login systems. If you want, you can change the PHP.ini value to reduce the session lifetime, so that it gets cleared faster. Search “session lifetime php” on google to find out more.