An embedded application on a Synology NAS is not automatically protected from accessing it without being logged in to DSM. Luckily Synology has an authentication mechanism, Web Authentication, described in their Developers guide. This enables you application to detect whether a user is logged in to DSM. Getting this to work for PHP is not that difficult, but you will encounter a few bumps on the road.
Not long after I bought my DS212+ I became interested in building my own embedded apps: packages that run within a window in DSM. I didn’t had much experience with Perl or Python, but I did with PHP. But I found out it wasn’t easy to get PHP to work as an embedded app without changing configuration files on the NAS, installing some other package first or forwarding a port. I want my apps to be usable for everybody in a user friendly way, so my first goal was to build an embedded Hello World app in PHP without any dependencies.