@Paul - sounds like the file is in your root directory. Move it over to the wp-admin folder and it will lock down that specific directory. The site will then be available publicly, but the wordpress backend and login will only be available to you.