When appending the querystring post_types = "name of your post type", it displays all the posts. I am using a plugin that has its own custom post type which is restricted (only users that have purchased a membership can view it).. but today while messing around with searching, i discovered that post_types querystring. Is there a way to prevent this private custom type from showing up? are there other similar "magic" querystring in wordpress?
register_post_type() has quite a few related arguments, of which
publicly_queryable controls precisely what you are describing.
However note that it will completely kill the CPT on front end — individual posts, archives, even post previews.
If you want to do this conditionally you'll have to manage this with code from scratch, which might get very involved to do comprehensively.