The documentation fails a little.

When securing a node it is only accessible thought the generated url. But when the node is promoted to the frontpage the url is published.

That makes sense, as the module uses path.module. On the site this was developed for, the nodes being protected would never be linked on the site. I think to change this behaviour the code would need to use a menu callback instead of using path.module.

When used for anonymous users, which i want to do, they need view access to the node type. So all nodes of that type are readable to that user. Nodes of the same type not protected by url_access are now in trouble.

This module isn't meant to handle that use case. You probably want something like content_access.

BTW: What is the search api searching for?

I'm sorry, what are you referring to?

--Andrew

I've updated the description page.