In this case, the problem is not that the creator of the HTML documents is likely to have the nefarious intentions. More likely, some student has figured out how the browser works, used the URL to locate it and then modified it. Fortunately, you can protect against this in both Word and Excel. Use the internal password protection of the application to make the file read-only. This is not foolproof.
Students can edit a copy of the file and delete the original file and substitute the copy.
There are ways to guard against even this kind of behavior, but at this point technical solutions are going to get you into an esclating battle of wits and social controls are probably preferable.