How to prevent a controller to run from web?

[eluser]mddd[/eluser]
@paulc010:
But where from would you call that module? I agree that the method (or even the whole controller) would not be available directly to a web user.
But the module must be called somehow. If the script which calls the module is open to the public, the module is also open. Or am I missing something in your explanation?