htaccess and htpasswd

Question

im trying to lock my admin panel from my users with adding htpsswrd file to wp-admin folder. but also i want my users can edit their profiles. so i create this file (htaccess)

AuthName "Username and password required" AuthUserFile ...../wp-admin/.htpasswd Require valid-user AuthType Basic

Order deny,allow Allow from all satisfy any

which works but, now when i try to access profiles, the site still askes password but also i can login. i think there are more files behind.

anyone know profile.php is using which files behind other than (user-edit.php)|(profile.php)|(users.php)

Answer 1

Your behavior is logical. the profile.php page is in the protected /wp-admin/ folder.
the wp-login.php is in the root (/), which is not protected.

Answer 2

You can add protection to individual files like (in your htaccess file):

<Files test.php>
require valid-user
</Files>
<Files test2.php>
require valid-user
</Files>