<?php
    if (!empty($_POST)) {
        $user = $_POST['user'];
        $pass = $_POST['pass'];

        if($user == "admin"
        && $pass == "admin")
        {
            $file = 'Путь к файлу';

            if (file_exists($file)) {
                header('Content-Description: download');
                header('Content-Type: ' . mime_content_type($file));
                header('Content-Disposition: attachment; filename='.basename($file));
                header('Expires: 0');
                header('Cache-Control: must-revalidate');
                header('Pragma: public');
                header('Content-Length: ' . filesize($file));
                ob_clean();
                flush();
                readfile($file);
                exit;
            }
        }
    }
?>

<form method="POST" action="">
    <input type="text" name="user" placeholder="Логин" /><input type="password" name="pass" placeholder="Пароль" />
    <input type="submit" name="submit"></input>
</form>