Oh I am fully aware, that’s kinda why I added the line:

but be warned if you take this route that the CSS can be re-enabled on the login screen using your browsers element inspect

In my original comment, hence why I also suggest just outright blacklist all IP’s and whitelisting the known few.