How to prevent public use of profile, while still allowing use via HTML snippet
You could probably do it at the webserver level, e.g. in apache using &lt;LocationMatch&gt; and then &lt;Limit&gt;. Untested, and you might have to fiddle or put it in the right place for clean/non-clean urls, or for specific gid params:
&lt;LocationMatch &quot;^/civicrm/profile/create&quot;&gt;
  &lt;Limit GET&gt;
    # allow just my own IP
    Require ip my.own.ip.address
  &lt;/Limit&gt;
&lt;/LocationMatch&gt;