If files are unreferenced then they should be removed from the web
root and/or the application directory.

Preventing access without
authentication may also be an option and can stop a client from being
able to view the contents of a file, however it is still likely that
the directory structure will be able to be discovered.

Using obscure
file names is implementing security through obscurity and is not a
recommended option.