g1smd - 12:59 pm on Aug 26, 2010 (gmt 0)

If you merely want it not crawled, then robots.txt will stop it crawling, but references to URLs on your site could still appear in Google SERPs as URL-only entries.

If you don't mind Google accessing the pages, but you don't want anything at all to appear in the SERPs then you need a meta robots noindex on every page.

If it really is private, then using .htpasswd is the way to go. That way there will be no access, no crawling, no indexing at all.