What is good way to hide update.php file? I will like to know what is the correct/better way to hide update.php file on the production server.

Currently when you try to access update.php file, Drupal shows default access denied page with info about how to edit settings.php file which I think is bit more revealing than is required.

Any suggestions or best practices ?
You can add the following line:

RewriteRule ^update.php$ - [R=404,NC,L]


to your .htaccess file so the web server returns a 404 rather than bootstrapping Drupal to show access denied.