title: mod_rewrite activated by WordPress prevents directory access directives
body: <p>I have the following .htaccess file placed in the root of my wordpress site:</p>
  
  <pre><code>AuthType basic
  AuthName "enter password"
  AuthUserFile /path/to/.htpasswd
  Require valid-user
  
  # BEGIN WordPress
  &lt;IfModule mod_rewrite.c&gt;
  RewriteEngine On
  RewriteBase /
  RewriteRule ^index\.php$ - [L]
  RewriteCond %{REQUEST_FILENAME} !-f
  RewriteCond %{REQUEST_FILENAME} !-d
  RewriteRule . /index.php [L]
  &lt;/IfModule&gt;
  # END WordPress
  </code></pre>
  
  <p>It worked well with my previous hosting provider returning 401 if no/incorrect password provided but when I've moved to a new one in case if no/incorrect password the visitor still able to load index.php, but without images, stylesheets and may be other external parts of the site, I haven't checked.</p>
  
  <p>When <code>#BEGIN WordPress / # END WordPress</code> part is removed then 401 error displayed, as it should.</p>
  
  <p>Is there a way to override this behavior? Without touching <code>#BEGIN WordPress / # END WordPress</code> part as it has been added by WP and could be modified without my attention.</p>
  
  <p>Also my provider claims it is normal behavior and I wonder if it's right or it just don't want to pay attention to this issue.</p>