If directories are unreferenced then they should be removed from the
web root and/or the application directory.

Preventing access without
authentication may also be an option and can stop a client from being
able to view the contents of a file, however it is still likely that
the directory structure will be able to be discovered.

Using obscure
directory names is implementing security through obscurity and is not
a recommended option.