This is a simple approach to protect pages and content with PHP, even if Javascript has been deactivated by the user. If you knew the absolute path to "/pages/profile.php", you could still read the content so far. If no current session is open you will now be directed back to the start page "index.php".
Even if this is better than pure Javascript and HTML, I cannot guarantee the security of the content. It is recommended to use a more professional solution like this one: https://github.com/kreait/firebase-php
https://medium.com/@bariskarapinar/firebase-authentication-web-app-javascript-3165ebc92b68