A home-page is only secure, if you can't apply your predisposed knowledge to find what lies behind it.
I wouldn't have been able to put it in any better form
+1 for that.
I'd also add, it's not the problem with the homepage, the problem is with the stupid staff themselves (not specifying any tracker here).. really, the lack of coding skills (or fear of messing things up) made them just send the variables values from one page (index.php or login.php) to some modded (index.php) so they can be sent to takelogin.php
Simply by setting a session with a hashed token that can be obtained only by inputting the correct username&password THEN and only then the other pages should be accessible otherwise they should redirect the user to the "fake" homepage.
it would something like this
function isLoggedIn(){
...;return true;
...;return false;}
if (!isLoggedIn()){
header ("Location:... .php");
exit;
}else{
//the rest of the page's code go here
}
and just add that to every page , include it or whatever, and with a good robot.txt..
one last thing, redirect 404 to the "fake" index.php
now there's no way to tell the different between a page that exist (login.php, browse.php..) and a page that doesn't, they all will redirect the user (if not logged in) to the "fake" index.php
and that's it