RewriteEngine On
RewriteBase /

# SSL Enforement
RewriteCond %{SERVER_PORT}     !^443$
RewriteRule (.*)  https://%{SERVER_NAME}%{REQUEST}

# Basic Auth protection
AuthType Basic
AuthName "secured area"
AuthUserFile /path/to/.htpasswd
require valid-user

# Protect every file excluding CSS, JS, PHP and HTML
<Files *>
  Order Deny,Allow
  Deny from all
</Files>

<FilesMatch ^$>
  Order Allow,Deny
  Allow from all
</FilesMatch>

<FilesMatch "\.(css|js|php|html|htm|var|png)$">
  Order Allow,Deny
  Allow from all
</FilesMatch>