my initial testing was slightly flawed it turns out

"blockCFAdmin":"true"

isn't working in server.json when using server rules as I initially thought. Using

block-cf-admin()

with server rules does block CFIDE with a 404.