In these circumstances, use the noindex tag if you merely want the website page not to appear in Google, but You should not head if any user that has a website link can get to the webpage. For authentic security, use good authorization procedures, like requiring a person password, or https://rsac.org