Which paths specifically? anything that gets hit should redirect to login.
Yes, login only means the only way you can access the site is by logging in. It’s still possible to get some bot traffic to the / or /login routes, because those need to be public to allow humans to log in, but it will be restricted to those routes.