I'd like to create a "private" website that clients can visit by typing in the provided direct URL (on a business card, for example), but is not password protected and would not be indexed by search engines. Is that possible?
If any of your clients post the URL in just about anything, search engines will likely discover it. They may also find it while crawling domain registration sites and the like...
As Google states here:
Even if you try to block crawling using robots.txt, noindex meta tags, or X-Robots-Tag HTTP headers, any mention of your site anywhere may result in crawling and indexing it by various search engines. As Google indicates:
The easiest way would be to use htaccess to send an HTTP header to tell the search engines not to index any of those pages. Put the following code in an htaccess file in your root web directory:
This will apply this header to every page in that directory and subdirectory below it and prevent those pages from being indexed.