Do not keep obsolete versions of files under the virtual web server
root.

When updating the site, delete or move the files to a directory
outside the virtual root, edit them there, and move (or copy) the
files back to the virtual root. Make sure that only the files that are
actually in use reside under the virtual root.

Preventing access without authentication may also be an option and
stop a client being able to view the contents of a file, however it
is still likely that the filenames will be able to be discovered.

Using obscure filenames is only implementing security through
obscurity and is not a recommended option.