rename your server.cfg to any cryptic filename maybe sfkdglsdfhgu.cfg and noone will find out your rcon... If you want it really safe go to your server cfg and change sv_allowdownload "1" to "0"