Not storing them in the web root would be the first thing. Is there a reason they need to go in the webroot?
If they must be there, then put them in a sub folder which is only accessible by the CF service, if anyone else navigates to them it will give them a 401/3
We avoid using custom tags but some of our legacy tags have code similar to the following:
<cfif NOT thisTag.hasEndTag>
<cfabort showerror="You need to supply a closing <CF_Head> tag.">
<cfif thisTag.executionMode EQ "end">...
You may be able to simply check for the existence of thisTag - isDefined("thisTag").
Another option is updating your application.cfm or application.cfc to white list the templates that can be accessed from the outside world. You can do the same via folders and access permissions similar to what haxtbh mentioned - but restructuring your app may be more difficult than <cfif NOT listFindNoCase("big.cfm,ugly.cfm,list.cf,of.cfm,files.cfm",cgi.script_name)><cfabort showerror="Go away!" /></cfif>
Sorry - they are not in the web root - they are in their own folder and available to all websites on the server.