In my web application all the .aspx pages resides in Pages directory. The project structure is shown below:
You need to disable directory browsing from IIS or from the web.config
this entry above applies to IIS 7+, for IIS 6 you'll have to do it from IIS Manager