Administration and Configuration of CBA Fusion applications is provided via Web Plugin Framework:
https://<application server address>/web_plugin_framework/webcontroller
For enhanced security you may prefer to disable the web access admin UI and use CLI for administration tasks.
To disable the Web Admin UI, you would need to un-deploy web_plugin_framework.war file.
Instructions on how to how to un-deploy file can found in Fusion Application Server Administration Guide.
Alternatively you can use Management Console CLI to undeploy file as below: