"In general, you should never use .htaccess files unless
you don't have access to the main server configuration file. There is,
for example, a prevailing misconception that user authentication should
always be done in .htaccess files. This is simply not the
case. You can put user authentication configurations in the main server
configuration, and this is, in fact, the preferred way to do
things."
ref: http://httpd.apache.org/docs/2.0/howto/htaccess.html
create the password file:
htpasswd -c /path/to/pass/file username
(only use -c the first time)
add to httpd.conf, do a graceful
<Directory /dir/path>
AuthType Basic
AuthName "whatever"
AuthUserFile /path/to/pass/file
Require valid-user
</Directory>