You can do this for specific endpoints in Caddy, or whole domains/sites.

If you create a matcher like

@wp-admin {

  path /wp-admin\*

  path /wp-login\*

}

Then you can just service up that handler's endpoints:

handle @wp-admin {

    basicauth {

       username pwhash_goes_here

       username2 pwhash2

    }

    # reverse proxy config etc, e.g.

    reverse_proxy http://127.0.0.1:8080

}

And now only the wp-admin and wp-login endpoints are protected, but the rest of the site is unaffected.