I might be nitpicking, but is it better to do this:
if ($loggedin) { // normal process } else { header('Location: login.php'); }
Or this:
if (!$loggedin) { header('Location: login.php'); exit(); } // normal process
Or does it just not matter?
I prefer the 2nd one because that way ‘normal process’ is not already 1 indentation level deep because of a simple check. I think PHP probably optimizes this away so that performance is irrelevant, so at that point it’s a matter of readability and the 2nd one makes more sense to me (‘Not logged in, redirect, exit’) over wrapping all your logic in one huge IF.