I hate messing with .htaccess files across multiple environments. I also find .htaccess a bit of black magic as I don't understand regex :)
So here's my approach.
In index.php - right after the opening PHP tag - drop this in:
if($_SERVER['SERVER_ADDR'] == '127.0.0.1') {
$username = 'username';
$password = 'password';
if (!(isset($_SERVER['PHP_AUTH_USER']) && ($_SERVER['PHP_AUTH_USER']==$username && $_SERVER['PHP_AUTH_PW']==$password))) {
header('WWW-Authenticate: Basic realm="This site is protected"');
header('HTTP/1.0 401 Unauthorized');
// Fallback message when the user presses cancel / escape
echo 'Access denied';
exit;
}
}
Obviously replace the IP address with the server IP you want to protect and an appropriate username and password.
This will only impact things routed through index.php - you'd still be able to access static html files and such but this works for most PHP apps I've found.