Can a physical connection to LAN to be required in order to configure router?
HI and Welcome to the forum!
Yes. You can create an additional VLAN / subnet for management then restrict webadmin access to that VLAN. You can present the VLAN on a physical LAN port or on a new dedicated SSID.
The option that controls this is in the System Tab, Admin Security.
Another approach is to have all Wi-Fi users assigned to VLANs and then restrict access to the router to the untagged LAN, which could be any Ethernet port. Anyone who has ever experienced a bad Ethernet port would be wary of limiting access to a single port.
Hi Martini,
I managed to disable configuration completely - requiring a 20sec reset. 
I think I “get” the mechanism of associating a VLAN with a physical port, I just need to wait until I have time to experiment.
Thank you for the suggestion!
Hi Michael,
I’m not sure which of those settings can accomplish my goal.
I changed the “Security” setting to https and the following parameter to “LAN only” but still get to login page via wifi. Of course all devices under the router are on the “LAN” (including those connected wirelessly. I’ll try experimenting with other methods when I have more time!
Thanks/Cheers.