How can I hide the url of the iframe
You can't. The browser needs the url to load the page and therefore it is in the source code. You see it in the source code and also in the network tab of all browser.
What you can do is that your iframe can only be loaded in a parent you define!
If you open the iframe page directly the page gets included into your page again. And if someone else is including the iframe the page gets also redirected to your page again.