Good point. There may be some things that are needed publicly, which you could whitelist. I've seen the whole directory behind the auth on a handful of sites though. ex] tether.to/wp-admin