Securing a plugin pop-up window

Add some AJAX actions in your plugin file, something like this… The first one (without _nopriv) will already only be executed for logged in users, and the second will only be executed for logged out users, so there is no need to retest is_user_logged_in() here:

add_action('wp_ajax_show_popup_contents', 'show_popup_contents');
function show_popup_contents() {
    $filepath = dirname(__FILE__).'/popup.php';
    include($filepath); exit;
}

add_action('wp_ajax_nopriv_show_popup_contents', 'deny_popup_contents');
function deny_popup_contents() {
    wp_die("You need to be logged in to view these contents.");
}

Then set the popup URL to /wp-admin/admin-ajax.php?action=show_popup_contents

You probably want to also add if (!defined('ABSPATH')) {exit;} at the top of the included popup.php file so it cannot be accessed directly that way.