When I press the login button, it deletes the cookie redirects to the main page. It works perfectly.
But when I press the “back” button (or backspace key), the logged in page still shows up. I want to prevent this for users’ privacy reasons.
How would you do it?
See this SO question/answer:
(PHP) How to destroy the session cookie correctly?
And also this question on cache control:
How to use HTTP cache headers with PHP
Basically, what you need to ensure you are doing is destroying the PHP session appropriately, and send proper caching instructions to the browser (essentially, not to cache).
Note the answer to the question I linked to states that, if you destroy the session on the server, the cookie itself is useless. Don’t rely on the cookie being removed to end a session.