If a client portal URL (which includes an almost impossible to remember code word) is compromised (suspected to have fallen into wrong hands), simply delete the client portal url in Settings/Tools/Reports -> Client Online Portals and recreate another URL for the same client.  The old URL will cease to work.