Howto protect default https://box.domain.com/admin URL under Password or by onlysome IP's allowed

Hi, I am a bit puzzled, you say the menus are populated once a user is logged in, but when not logged in I can still see my webmail address and email settings (not email accounts or aliases) in Mail>Instructions on the"Checking and Sending Mail" page and also the urls for Calendar and Contacts on the “Contacts & Calendar Synchronization” page.

Is it possible I have not set something up correctly or is this information always public?

Thanks in advance,
David