Block website by country but access back and front end when logged in

[fritex]

@Takaski

if an admin is logged in

You might want to use a plugin for example like some of the “maintenance mode” plugins, or take a look a bit on WordPress documentation about function is_user_logged_in() - > is_user_logged_in() | Function | WordPress Developer Resources and implement it to your need into your theme functions.php or index/home.php file to show all the content if user is logged into, while nothing if user isn’t logged into (also you can combine it with checking what logged-in user can do, or by it’s e-mail, or if it’s admin or not, else therefore based on the “privileges” determine further actions) → current_user_can() | Function | WordPress Developer Resources.

You can also set and send some HTTP header, or cookie, then check it with Firewall Rules or similar approach and ideas.

Using Cloudflare Access / Teams, this can be done, and I know enough people already using it and working fine

Combining Cloudflare Access and Firewall Rules to protect WordPress

You shouldn’t need such blanket protection of the wp-admin directory. I spend a lot of time combing through WordPress logs and find the worst offenders seem to be targeting wp-login, xmlrpc, and admin-ajax. Plus other random fits of inspiration: vulnerable plugins, random config files. My approach is to use Access to protect wp-login, then Firewall Rules to Challenge or Block all the other noise.