I have just noticed that just by typing in the routers ip address into my browser and selecting graphs I can see all the pppoe usernames of all my customers connected to the router.
How do I block this to prevent my customers from seeing this page?
Either set a range of IP addresses that the service is accessible from in /ip services or set up a filter rule that will accept port 80 from an address list and drop everything else if you don’t want them to have access to the web interface at all but want to keep it for yourself.
The other option is add in each interface separately in the graphing option and define what IP address it is accessible from, you can add an interface multiple times to allow access from multiple IP addresses.