Password protect for arduino webserver?

A question to those who know more than I do...

Not "rigorous", but suppose I had a little web server, and wanted only me to be able to make it do it's thing.

Suppose the webserver's URL was "MyWS.com"

It would be easy (well, relatively!) to program it to respond only to, say...

MyWS.com?pw=MyPassword123

What avenues would be available to Bad Guys who wanted to find out how to get the web server to do whatever it is programmed to do when accessed with the extra bit?