As every lawyers first sentence: It depends. So without exactly knowing what you did, let's do a little "risk-assessment".
There are multiple ways of compromising wordpress based websites:
- knowing the admin-credentials
- finding a vulnerability in wordpress
- discovering a vulnerability in one of the used plugins
- finding a vulnerability in the webserver or it's configuration
Where vulnerability as in: Software-vulnerability, misconfiguration and so on.
Also we have to further split all those possibilities into two options:
- going from zero to admin
- escalating from user to admin
So let's see what you have accomplished: If the admin-access really is blocked and properly blocked, knowing the admin-credentials is not a direct threat to the page anymore (it can still be if you reuse credentials from somewhere else or if your .htaccess or function does not block all the resources properly).
There is still multiple options to go for when targeting your site. I suggest you have a look at this page. The statistics are a little too agressive in my opinion but you will get a feeling for the problems you might face when protecting your site.
“73.2% of the most popular WordPress installations are vulnerable to vulnerabilities which can be detected using free automated tools.” – WpWhiteSecurity.com
This seems quite a lot to me but it's not unimaginable. That is not exactly what you are asking but it's some information to consider when thinking about how to lock down your site.
There also is a quote about credentials but its really out of context so read the links carefully before really making your opinion.
So without knowing your exact target or your exact approach: Locking down your admin account is a nice approach (if it works properly) but credentials are not the only way to transform wordpress installations into something else. And probably (careful; assumption) they are not really needed in most of the cases. If someone manages to find some SQLi or RCE in your WP installation (not unlikely as shown before) or one of the plugins (even more likely) your security measure might not really catch.