it's an old topic but I was looking for something like that and found it
first, thanks Anna for your answer, it helped me
but I see 2 problems:
- leading ^ => /admin/ will be protected but /index.php/admin/admin/ won't be
- trailing / => /admin/ will be protected but /admin won't be
so I use "/admin" instead (except I don't use "admin", see below)
so yes, frontend URL containing "/admin" will be caught
but remember that we are talking of the "admin" token only if you chose to let "admin" as identifier to your admin panel
you should change this identifier and put something harder to find and that you won't get in frontend
and code for Apache 2.4:
SetEnvIfNoCase Request_URI "/[your admin identifier here]" ADMIN
AuthType basic
AuthName "Restricted Access"
AuthUserFile [path to your .htpasswd here]
<RequireAny>
<RequireAll>
Require env ADMIN
Require valid-user
</RequireAll>
<RequireAll>
Require not env ADMIN
Require all granted
</RequireAll>
</RequireAny>