my very old DLink wifi router (which is ONLY on the LAN) has a checkbox to allow remote admin from outside the LAN, i.e. via the WAN port. Of course it is OFF. I think there's also another one that allows someone on the wifi network to configure it, and I believe THAT one is OFF as well.
(unfortunately they were ON by default, as I recall - it has been many years since i set it up)