If you add a host name with your registrar the site then becomes available for everyone in the world. Even with a login you could have some leakage.
If your site is set up to only answer to http://test.sitename.com and the only place you put the translation for that is in your local host file there is no opportunity for leakage. You don't have to worry about trying to block access other ways.
