title: .htaccess auth files with wordpress
body: <p>I'm trying to use basic .htaccess authentication in a subdirectory of the root where Wordpress is installed.  The problem is the same as <a href="https://stackoverflow.com/questions/1641666/htaccess-rewrite-and-auth-conflict">this question</a>.  The root .htaccess file that Wordpress uses for permalinks doesn't play nice with a .htaccess file I have in a subdirectory that requires authentication.</p>
  
  <p>However, the solution does not work, and even if it did, I cannot use that solution.  This is because Wordpress's htaccess generation overwrites anything I put in that section.</p>
  
  <p>What it generates is:</p>
  
  <pre><code>&lt;IfModule mod_rewrite.c&gt;
  RewriteEngine On
  RewriteBase /
  RewriteRule ^index\.php$ - [L]
  RewriteCond %{REQUEST_FILENAME} !-f
  RewriteCond %{REQUEST_FILENAME} !-d
  RewriteRule . /index.php [L]
  &lt;/IfModule&gt;
  </code></pre>
  
  <p>And what I would like to stick in that RewriteCond list is</p>
  
  <pre><code>RewriteCond %{REQUEST_URI} !(^/admin(/.*)?$)
  </code></pre>
  
  <p>Navigating to <a href="http://www.example.com/admin" rel="nofollow noreferrer">http://www.example.com/admin</a> should use the .htaccess file in that directory to authenticate the user.  eg:</p>
  
  <pre><code>AuthName "Admin Area" 
  AuthType Basic 
  AuthUserFile "/home/.htpasswd"
  AuthGroupFile "/home/.htgroups"
  require valid-user
  </code></pre>
  
  <p>Navigating to <a href="http://www.example.com/anywhereelse" rel="nofollow noreferrer">http://www.example.com/anywhereelse</a> should redirect to index.php</p>
  
  <p>As it is, I can't even get the RewriteCond shown here to work.  It always just shows the 404 page when going into the /admin directory, unless I remove the <code>require valid-user</code> line from the admin .htaccess file.  One thing to note is that on that 404 page, the response still contains the WWW-Authenticate header.</p>
  
  <p>So main questions are:</p>
  
  <ol>
  <li>How can I make this work?</li>
  <li>Why doesn't it just work as is?  Why do I need to exclude the /admin directory?</li>
  </ol>