You have to restrict access to a few folders and files. you can do that by disabling anonymous access on IIS on the following folders /files as described [here][1]:
admin folder
login folder
shell folder
default.aspx page
The links shows you how to disabled that as well [1]: https://doc.sitecore.net/sitecore_experience_platform/setting_up__maintaining/security_and_administration/access_rights/restrict_access_to_the_client