When you restrict IP's you should not be able to still login.

Even after a ip has been restricted you can still login all be it to a white page. the login details should not be available to any one but the approve IP's