Facts
Before we delve into designing the fortress, it seems best to remember a few facts about the period itself:
- recreational climbing/exploration wasn't a thing,
- most people in a medieval era never left their village, the few trappers would follow game, not venture into arid areas for the fun of it,
- trips, whether at sea or in the mountains, were slow-going and dangerous; natural disaster, lack of medical knowledge, wild animals (wolves/bears in mountainous areas) made Nature the greatest enemy, it was expected that travelers may run into trouble and possibly never come back,
- in the absence of science, suspicions and myths ran the gamut.
Picking a location
A remote location is unlikely to ever be visited; which minimizes the risks of discovery. Thus, just picking a remote location off the main travel roads is already a significant step in the right direction.
A seemingly arid location also helps; if there is nothing to gain, no bounty, game or lush fields, then only fools will willingly set up to explore the area.
This can be exacerbated if rumors of dark forces, monsters, spirits, etc... scare people away. If nobody ever comes back, such rumors will form without any active intervention: people wish for an explanation, they'll make one if none is readily available.
Depending on the nature of your hidden people, they may choose to integrate the unlucky wanderers, bribe them or kill them, to ensure their secret remains secret.
Hiding the location
It is best if, on top of being in a remote area, your location is only accessible with difficulty.
I would elect a deeply ensconced valley, cut-off from the world on 3 sides by nigh impassable mountain ranges. Or even the crater of a former volcano.
If there are accessible paths, they can be concealed or rendered impassable, at your leisure.
Remote, inaccessible, and with nothing to earn in sight: why would anyone go there?
Which actually ties in with the fact that you should aim for autarky. Being self-sufficient will mean that your own people have little reasons to wander about. If only a select few (rangers/spies) go out, they can be trained in not leaving obvious trails and concealing their travels. Also, patrols are great to (1) make wanderers go away and (2) warn of incoming threats.
Self-sufficiency is actually easy in this case: you have fresh air, pure water and arable land (at least on the volcano). A few trees would not be amiss for construction material/heating, which if you do not pick too high a spot will be easy.
Note that most of the times your people should live in the valley/crater itself, not the fortress. This makes life more comfortable.
Designing a fortress
The fortress itself will depend on the location. And how hidden you want it to be.
If the location is sufficiently hidden, then the fortress itself can be as blatant as you wish it to be. Obvious locations include:
- the island in the middle of the lake (for a crater),
- the top of the valley, with its back to the mountain and flat terrain in front for shooting practice,
- a cave system.
In any case, an approaching enemy will make a good target for archers, making it costly for an assailant to close in. The lake is maybe the worst case for an assailant, especially if the island is hard to land on (naturally, or artificially).
In the case of the cave, note that you have no need for big entrances, which is great since those are harder to defend anyway. A man-size entrance can be closed off by rolling a stone from the side (good luck to whoever attempt to break through it). Otherwise, hearses/thick doors with egresses to harass the assailant will do, especially if you have several sets of them.
I would recommend putting the food storage inside the fortress itself; this would make it extremely costly and difficult to besiege the fortress, especially as your patrols could harass the enemy, focusing on destroying/spoiling its own food storage in a war of attrition.