It’s not a Unity question. UnityWebRequest do not require any unusual permissions to operate. If your php script is working in with regular browser or any common www api testing suite, it should also work fine with UnityWebRequest. Refer to your web server man pages to configure public folders permissions.
In your script you could require certain information sent from your build to the web server which wouldn’t be obvious to anyone who just opens the page in their browser. But someone determined will eventually be able to find it by sifting through your build or using wireshark.