This paper investigates the physical-layer data secure transmission for indoor visible light communications (VLC) with simultaneous lightwave information and power transfer (SLIPT) and random terminals. A typical indoor VLC system including one transmitter, one desired information receiver and one energy receiver is considered. The two receivers are randomly deployed on the floor, and the random channel characteristics is analyzed. Based on the possibility that the energy receiver is a passive information eavesdropper, the secrecy outage probability (SOP) and the average secrecy capacity (ASC) are employed to evaluate the system performance. A closed-form expression for the lower bound of the SOP and an exact closed-form expression for the ASC are derived, respectively. To further improve the physical-layer security, a protected zone based scheme is proposed, and then the SOP and the ASC are re-derived. By using Monte-Carlo simulations, the accuracy of the derived lower bound of SOP and the exact ASC are verified. Moreover, numerical results show that the security of the VLC system significantly improves by employing the protected zone. INDEX TERMS Visible light communications, physical-layer security, secrecy outage probability, average secrecy capacity, SLIPT, random terminals, protected zone.