Protect against URL fuzzers?

I have some files that I want to be private and only accessible if you are given the url. However, I have recently found that people are able to use 'url fuzzers' on my host and they can get all directories and subdirectories. I'm not really sure how these work, so could you guys help me out with this? I'm guessing if they just bruteforce then I could just name the file something long and complicated, but again I'm not sure how it works.

Thank you,

Josh