You can do this for specific endpoints in Caddy, or whole domains/sites. If you create a matcher like @wp-admin { path /wp-admin\* path /wp-login\* }

You can do this for specific endpoints in Caddy, or whole domains/sites. If you create a matcher like @wp-admin { path /wp-admin\* path /wp-login\* } Then you can just service up that handler's endpoints: handle @wp-admin { basicauth { username pwhash_goes_here username2 pwhash2 } # reverse proxy config etc, e.g. reverse_proxy http://127.0.0.1:8080 } And now only the wp-admin and wp-login endpoints are protected, but the rest of the site is unaffected.