Use .htaccess (Apache) or location blocks (Nginx) to require HTTP authentication for any directory containing view and .shtml files.