 <p>I think your problem is, though we destroy session we can still access the page that should be loaded only if the user in logged in.</p> <p>For example, when user log in with correct credentials the url should look like this: localhost/app/controller/function (just for instance). And later when the user log out you will redirect back to login page. But if we type localhost/app/controller/function in url or if we click back button in browser, the browser will load the page !!! I consider your stated problem is same like this.</p> <p>For this problem I always use a solution in every function of controller. Like;</p> <pre><code>class MainController extends CI_Controller { function test { $user_name = $this-&gt;session-&gt;userdata('user_name'); if(isset($user_name)) { //the actual function code goes here } else { //redirect to the login function } } } </code></pre> <p>I hope this helped some one.. cheers..</p>