Drupal/.htaccess

https://www.drupal.org/node/47092#comment-1194271
https://www.brontobytes.com/knowledgebase/202/htaccess-URL-Masking-Examples.html

To access the files in the directory:
add a .htaccess file to that directory containing Options All

To make simple .htaccess password protection work:
e.g. for something like this

AuthType Basic
AuthName "Files for my friends"
AuthUserFile "/home/mysite/.htpasswds/passwd"
require valid-user
edit the drupal-web-root/.htaccess file (eg. public_html/.htaccess) and add a Rewrite Condition
i.e. Find...

  # Rewrite current-style URLs of the form 'index.php?q=x'.
  RewriteCond %{REQUEST_FILENAME} !-f
  RewriteCond %{REQUEST_FILENAME} !-d
  RewriteRule ^(.*)$ index.php?q=$1 [L,QSA]
and add RewriteCond %{THE_REQUEST} !/path-to-directory/.* before the ReriteRule

to get...

  # Rewrite current-style URLs of the form 'index.php?q=x'.
  RewriteCond %{REQUEST_FILENAME} !-f
  RewriteCond %{REQUEST_FILENAME} !-d
  RewriteCond %{THE_REQUEST} !/path-to-directory/.*
  RewriteRule ^(.*)$ index.php?q=$1 [L,QSA]