<?php
session_start();

if ($_POST['user']) {
  $user = $_POST['user'];
  $pass = $_POST['pass'];

  $user_correto = "root";
  $pass_correto = "root";

  if ($user == $user_correto && $pass == $pass_correto) {
    $_SESSION['user'] = $user_correto;
    $_SESSION['logado'] = "ok";
  } else {
    header("Location: login.php");
  }

}

if (!$_SESSION['logado']) { header("Location: login.php"); }