Ok as I said first your frameset will not be password protected. The top frame is to be invisible and loading a blank frame. The second (bottom) frame is to be linked to your members area. Now all the program/visitor sees is the frameset name not your members area url because that is just loading in a frame. Now there are only two ways a hacker can find out where your true members section is first is by opening the pages source. To avoid this there are java scripts/codes out there that hide the page source. The second is by right clicking on an image and find its url... thats why you forbid right clicking (again with java) The last way is by the hacker watching the bottom of the navigator to see where everything is loading from.... Stop this by using scrolling texts at the bottom of the frame page
Hows that or should i create an example?