Cloudflare Access protects the main hostname and an alternate admin listener...

The primary route is locked down, yet the same backend remains reachable through an overlooked alternate hostname.