<script >
if ( window.history.replaceState ) {
window.history.replaceState( null, null, window.location.href );
}
</script>
elseif ($_POST['user']!= '' AND $_POST['pass'] != '') {
header("Location: index.php");
$_SESSION['login_fail'] = true;
exit();
}
...
if (isset($_SESSION['login_fail']) && $_SESSION['login_fail'] === true)
{
echo '<p class="msg">Не правильный логин или пароль!</p>';
unset($_SESSION['login_fail']);
}