If files are unreferenced then they should be removed from the web
root and/or the application directory.

Preventing access without authentication may also be an option and 
can stop a client from being able to view the contents of a file, 
however it is still likely that the directory structure will be 
able to be discovered.

Using obscure file names is implementing security through 
obscurity and is not a recommended option.