You can do this from the Login section of your Discourse settings page. Select the
login required setting to prevent anonymous users from viewing the site.
This means that the WP Discourse plugin can make API calls to your DIscourse site, but it does not mean that your WordPress site is allowing requests made from Discourse to get through. When you click the “Show Full Post” button, Discourse attempts to make a request to your WordPress site to scrape the post content. It seems likely this request is being blocked.