Hide the public WordPress frontend behind a secret URL parameter. Anyone with the link gets in; everyone else sees a 404.