add_filter('posts_search', function($search) {
  if (is_search()) {
    $search .=  " AND post_name NOT LIKE '\\_%' ";
  }
});
add_action('template_redirect', function() {
  global $post;
  global $wp_query;
  if(substr($post->post_name, 0, 1) === '_') {
    $wp_query->set_404();
    status_header(404);
  }
});