How to manage access to PHP Custom Pages

[Gilbertdelyon]

I am playing with PHP custom pages to see what I could do with this tool.

I have added my-php-page.php in mysite.xxx/php-pages/global_pages folder and created a new menu item, only for aministrators.
It works!
So far so good.

And now I disconnect from the site, delete browser cookies and enter the url as follows:
mysite.xxx/php-pages/global_pages/my-php-page.php and Ooops, the page is displayed.
This is not at all what I expected. Our site is fully private, you need to be logged in to see most of its content.

Question:

• Is this behaviour the normal one?
• How could I protect the php pages so that you can visit them only from the parent site.? ( I am not at all an expert of .htaccess)

Thanks in advance for your precious help.

[Gilbertdelyon]

In the meantime I found a way with some simple htaccess files. It works for a few simple pages, but...

But the background idea would be to embed a child site in php custom pages (example: a Wordpress site to publish articles that only the parent site authenticated users could see).
So, I would need to protect the child site so that only the users of the HH parent site could see it.
I would appreciate any advice in this matter.