How to secure URL?

That should be a setting for the domain on your webserver; not sure what; not that familiar with the Microsoft side of things.
You should normally get an error that the contents of the directory can not be shown.

Work around
Check your server configuration to see which files are supposed to be displayed if the user navigates to a directory without specifying a page. It usually will contain Default.* (aspx and / or html) and / or index.* and / or home.*. Create a dummy page with one of those names and place it in the directory that contains the folders that you see.