It’s quite simple – on the most basic level, you must create a user database; a login page that validates the users’ credentials against that database and then sets a session or cookie value that signifies that browser as being “logged in”. On your private pages, simply check to verify that session or cookie value is present; if not, redirect back to the login page.
Obviously it can get much more complex, but I’m assuming you need to start with the basics since you’re asking about it on Y!A.