unpublished resources visible?

<?php
if ($modx->event->name == 'OnWebPageInit') { 
  //CONFIGURATION
  // server paths - no trailing slash!
  $secureserver = "https://www.ourdomainname.com";
  $insecureserver = "http://www.ourdomainname.com";
  $resourceId = $modx->resourceIdentifier;
  
  if ( intval($resourceId) ){ //exclude if not an id
  
    
    $encryption = FALSE;
    $urlType = 'http';
    $doc = $modx->getObject('modResource', $resourceId);
    $secure = $doc->getTVValue('encryption'); 
    if($secure=='1') {
      $encryption = TRUE;
      $urlType = 'https'; 
      } 
    $modx->setPlaceholder('urlType',$urlType);
    $url = $_SERVER['REQUEST_URI'];
    $ssl = FALSE;
    if($_SERVER['HTTPS'] == 1)  {
          $ssl =  TRUE;
    } elseif ($_SERVER['HTTPS'] == 'on'){
          $ssl =  TRUE;
    } elseif ($_SERVER['SERVER_PORT'] == 443) {
      $ssl = TRUE;
    }
     
    // switch between http / https if necessary
    // if $secureserver === $insecureserver (eg you are testing locally)
    // then comment out this code block to avoid infinite recursion
    if($encryption && !$ssl) {
       // if SSL off and we are about to access a secure page then redirect
      $modx->sendRedirect($secureserver.$url);
    } else if ($ssl && !$encryption) {
      // if SSL is on and we are about to acccess an unsecure page then redirect
      $modx->sendRedirect($insecureserver.$url);
    }
    
  }//exclude if not an id
}

// switch between http / https if necessary

if ($resource->get('published') == false || $resource->get('deleted')) {

    $modx->sendErrorPage();
}