First, decide what "reach" means. /cdna-admin is meant to be reachable: anyone, signed in or not, gets its sign-in page. What must not happen is a member signing in there, or getting admin data. Check in order:

  1. The account is not a frontend user. The admin turns away only users of type frontend. Every other type can sign in, including backend, which reaches the admin with whatever permissions the site gives it. Check the user's type in the admin.
  2. Registration creates backend users. The registration Type setting offers backend as well as frontend. Set to backend, it gives every visitor who registers an admin login. It must be frontend.
  3. It is the site's own page, such as /staff, not the platform's admin. A page is public unless its record is restricted to a group, and a check in the template is not enough (template gating and route gating).
  4. It is the API. A signed-in member who calls a default API route is refused: with a 404 by default, or a 403 if the security setting "Access Denied (Authenticated)" is set to "Show Forbidden error (403)".