Why is my content not hidden? I set up a rule that blocks access to a specific piece of content. In fact, for simplicity's sake, I made a rule that blocks everything:

function namhost_node_access($node, $op, $account)
{   
    return NODE_ACCESS_DENY;
}


The problem is, if I go to:

/node


And browse through all the content, I still see data that I deliberately blocked. Why are these showing? Is /node some kind of view with full access to anonymous users? Is my access rule not being enforced for some other reason? Am I not understanding what the point of /node is and if I just block that path will I be fine?

Also, are there any other ways that people can access content types I've blocked? It's making me worried that I am able to access content that has been deliberately blocked.
Look at the documentation for hook_node_access, here:

https://api.drupal.org/api/drupal/modules%21node%21node.api.php/function/hook_node_access/7

The key is where it says: 

Also note that this function isn't called for node listings (e.g., RSS feeds, the default home page at path 'node', a recent content block, etc.) 

You probably want to check the link following that comment, i.e. the node access rights description, which got more complicated in D7 from D6.

Another thing to pay attention to is: if you're logged in as user id 1, then you won't be affected by those node access grants.