How static pages are defined as restricted pages

How do static pages be defined as restricted pages?
When I look at authentication, I mention the concept of HTTP authentication, which means that if a user reads a protected resource, the server returns a 401 so that the browser pops up a login window based on the 401来. This process is well modeled in PHP, such as this:
3 $username = ' snailhope ';
4 $password = ' 123456789 ';
5//When you just log in to this page because this is the user and PW are not set also to make a validation box call
6 if (!isset ($_server[' Php_auth_user ')) | |! Isset ($_server[' PHP_AUTH_PW ')
7 | | $_server[' php_auth_user ']!= $username | | $_server[' PHP_AUTH_PW ']!= $password) {
8//Set this page to no access
9 Header (' http/1.1 401 Unauthorized ');
10//Call verification box for login verification
Header (' Www-authenticate:basic realm= ' login authentication ');
Exit (' Verification failed!!! ');
13}

I would like to ask is that if it is a static page, there is no way to write code, then how to define a page as protected?

------Solution--------------------
Now basically there is no place for you to use the above authentication method, the experience is not good security is not high ...
If you need to control a page, you can use the Include method after judging permissions. or read the page content output.
Pages can be placed outside the Web directory.

Protection is, of course, done on the server. Unless you're doing CS development.

