You'll need to check on each page that's supposed to be protected to see if the person requesting it is logged in.
One approach involves setting session variables which can then be checked on subsequent pages (elaborations and bulletproofing to taste).
I'm sure there are articles on this subject on this site.