One thing I forgot to mention is that a Search Engine will not spider a website/page if it is not submitted to the Search Engine or linked to.
If you don't want Search Engine indexing certain pages on your website you should use
robots.txt.
However, anyone can view this file (e.g.
www.yourdomain.com/robots.txt), so it won't stop hackers from finding your hidden files/folders. As long as they are password protected it will be fine
If your website control panel (e.g: CPanel) has its own password protection system(CPanel uses .htaccess), it might be a better idea to use it as it will be even more secure.