Make sure user is logged in then show pages EXCEPT for login page.

[eluser]Pert[/eluser]
[quote author="behnampmdg3" date="1370180842"]Also I think it should be controller not model.[/quote]

If you think about it, user is a model, right?

So why not make this user model to automatically get user session before anything else happens and redirect if user is trying to access pages it should not access?

If you add this code to every single controller, you're just duplicating code.

When you forgot to add that check to one of the controllers, random visitors will have access to part of your website, so why not do it automatically, doesn't matter if you or anyone else has to add controllers in the future and forgets or did not know to add check routines.

If users have different access levels, then sure, there will be some checks in individual controllers, for example random person should not edit someone elses post like it was their own, but to cover basic log in, model is the way to go.