Very helpful article from hostgator here http://support.hostgator.com/articles/specialized-help/technical/wordpress/wordpress-preventing-you-from-password-protecting-a-directory shows up a problem which can drive many people crazy if they’ve got WordPress installed at root alongside other CGI password-protected folders. In short, there’s a missing / here: RewriteRule . /index.php [L] which would be better being RewriteRule ./ /index.php [L]