Webmin/Virtualmin has a built-in way to restrict access to a website.

Go to your virtual server and then go to Services > Configure Website

Click on the directory you want to restrict. For your entire website, select your public_html directory.

Select Access Control

Select your blocking method and then enter your IPs, hostnames, networks, etc.

• Deny then allow: Block all requests except if they're allowed.
• Allow then deny: Allow all requests except if they're blocked.
• Mutual failure: Allow access only if it matches an Allow statement and it does not match a Deny statement.
• Default: Use the virtual server's default method (in most cases, it will always allow all hosts).

If you need more fields, save and then come back to the Access Control section and another field will be available.