I created a CRON job that runs a .php page every day.

The php page queries a mysql db to find all appointments from yesterday and then sends them a thank you email.

It works just fine.

I was wondering, since I have this page on my server, how can I protect the page so people don't find the page and open it, thus running the code and possibly resending emails to the same people over and over again?

Also, can this happen if a bot visits the php page?

As I type, I am wondering if I should move it outside the public part of my server. I guess that would stop nosey people from running the script, but are web crawlers an issue yet?