You got it a little mixed up. If the web port rejects connections there is no way you cand serve a web page to them, they cannot get to the web server.

Th term that you shoud be searching is "port knocking" though I don't know how easy is to do from a mobile phone, it's not exactly a nice user experience. And then you have to decide how long to keep an IP whitelisted and other inconveniences.

In the end there's real reasons everybody relies on web auth.