How to prevent unauthorized access to drafts?

it seems that some people view my unfinished drafts.

No – they cannot. Try logging out and checking for yourself.

OK. Thanks. Good to know. So even with the correct draft URL, no one can actually view it unless they’re logged in.

Yes. It’s absolutely locked down.

The only thing that confuses me is that when I log out of my WP and then try to access this URL:

https://blog.cyberquill.com/?p=17799&preview=true

I arrive at my 404 error page, and this visit shows up in my Google Analytics as this URL:

https://blog.cyberquill.com/404.html?page=/?p=17799&preview=true&from

Because now the page I actually visited was my 404 page, not the draft I had attempted to visit.

So when my Google Analytics shows me that https://blog.cyberquill.com/?p=17799&preview=true was accessed (as opposed to https://blog.cyberquill.com/404.html?page=/?p=17799&preview=true&from) and it wasn’t me, I just hope what Google Analytics means to tell me is that only the 404 page was accessed after all.

Does your theme include a 404.php template file?

Yes.

https://blog.cyberquill.com/404.php

Review creating a 404 error page and check to see if your 404 template is sending out the right response header.

Not sure what “sending out the right response header” means, and I can’t find the section on “creating a 404 error page” that deals with response headers.

What I can say with certainty is that my custom 404 page gets the same header (<?php get_header(); ?>) as all the other pages on my site.