How can I restrict access to my website via web services only?
Assume a setup like so:


Assume that for site access via Services you use an account called "ServicesUser".
Create a new role, say you call it "ServicesOnly".
Make sure that there are no other "custom" roles in your site apart from anonymous, Authenticated and Administrator (if there are any: remove them again).
Authorize only user "ServicesUser" for this role "ServicesOnly".
Tune your permissions where appropriate, so that:


No permissions are granted to Anonymous or Authenticated.
All permissions are granted to Administrator (but only in case you have a need to ever login without using services, with a userid different from user/1, if there is no need for that, then no permissions granted to Administrator either).

Granularly issue permissions to role "ServicesOnly", so that "ServicesUser" receives appropriate permissions whenever required.
Whenever the site is switched to maintenance mode (eg to apply Drupal updates), ServicesUser will not be able to login either, which is what you should want also.


With a setup like above, access via Services (and userid = ServicesUser) should work as desired. While I cannot think of any other user who can do anything on your site, except user/1 (and optionally some other user who has access to role Administrator).

With this configuration, these are the only ways around it that I can think of:


Some security issues that are exploited somehow.
Somehow getting access to the ServicesUser account


Note: no additional contributed or custom) modules needed either ...