I am trying to establish how secure my website is. I was thinking of
using it to store documents on so they would be available wherever I
am.

Question if there is no html link to those documents is it possible
for them to be retrieved by a malicious user.

Question if I protect an area by using a password (my ISP offers that
facility) and create an html list of these docs, can a malicious user
get access to this html page?

Tom