What is good way to hide update.php file?
You can add the following line:

RewriteRule ^update.php$ - [R=404,NC,L]


to your .htaccess file so the web server returns a 404 rather than bootstrapping Drupal to show access denied.