The following paths should only be accessible in a password protected Instiki setup.
/<wiki>/published
/<wiki>/feeds
Other paths could be protected by SSL password. Especially edit and edit_web should certainly be protected.
/<wiki>/edit_web
/<wiki>/show
/<wiki>/edit
/<wiki>/diff
/<wiki>/history
/<wiki>/revision
/<wiki>/list
/<wiki>/recently_revised
/<wiki>/authors
/<wiki>/export
The protection could easily be setup with NGINX as webserver front end.
TBD.
Note that you need to publish the wiki before it is available to the general public.