Pages with Visibility; “password protected” can be viewed without a password

We have a sailing club website that has a number of mildly sensitive documents whose access we restrict to club members (e.g. our member directory with names, phone numbers, and email addresses). We don’t want to manage individual accounts for all members, so we restrict sensitive documents by setting the Page Visibility to “password protected” in the Publish sidebar of the Edit Page menu. All sensitive pages are protected with the same password, which is printed on our membership cards. Not iron-clad security, but not highly sensitive material, either.

We recently discovered that these documents can be accessed without a password from a URL like: https://americansailinginstitute.org/wp-content/uploads/%5Bdoc-name%5D.pdf. This wouldn’t be too bad, except that google has indexed the documents and exposed the URLs! I’ve removed the sensitive documents, but am looking for a solution that keeps password protected pages really password protected.

The common solution seems to be to add a redirect to the .htaccess file to restrict access to users who are logged into wordpress. I’d like to avoid individual user accounts, though.

I think I need to move our sensitive documents “above” wp-content and public_html? Can I do this and still keep their permalinks the same? How would I do this, or is there some better solution?

The website is at: https://americansailinginstitute.org/

Best regards,
David Ei