I found an elegant solution from junkster at https://www.webmasterworld.com/apache/3688208.htm
“Simply by declaring and creating a valid 401 document
*not in* the protected directory, *then* the ‘protected
directory’ behavior works with the wordpress code.
To summarize what I’ve done – and believe to be the minimal implementation:
I created 2 files:
/Forms/401.html
AUTHENTICATION REQUIRED
If you have been granted access,
you will have an email with user
and password details.
/protected-dir/.htaccess
ErrorDocument 401 /Forms/401.html
AuthType Basic
AuthName “Paid Member”
AuthUserFile “/home/acct/.htpasswds/public_html/protected-dir/passwd”
require valid-user ”