I have a site with sensitive data on it stored in the cms - where there is no option to password protect pages. These pages only need to be accessed through URLs so it works fine. If I don’t publish the sitemap, is there any other way that someone can find these pages?
Logically, no. Practically, yes. If someone or a program wants to find something, they’ll actively look for it.
But don’t do it, find another way.
Robots crawl the web, not only Google’s, ot only search engine robots. They can use predictive strategies to reach pages that aren’t linked. There’s more and more data to steal. It was payment infos, then personal stuff for impersonation, now cryptocurrencies data. This trend is only getting stronger.
Sensible data online must be encrypted at the very least. You’re using a service (Webflow) and even if you password protect a page, well, anyone working for the service can access it.