Настроить basic auth в подпапке wp

Есть htaccess от wp:

###BEGIN Swift Performance### # ------------------------------------------------------------------------------

# | Compression |

# ------------------------------------------------------------------------------

# Force compression for mangled headers.

# http://developer.yahoo.com/blogs/ydn/posts/2010/12/pushing-beyond-gzipping

SetEnvIfNoCase ^(Accept-EncodXng|X-cept-Encoding|X{15}|~{15}|-{15})$ ^((gzip|deflate)\s*,?\s*)+|[X~-]{4,13}$ HAVE_Accept-Encoding

RequestHeader append Accept-Encoding "gzip,deflate" env=HAVE_Accept-Encoding

# Compress all output labeled with one of the following MIME-types

# (for Apache versions below 2.3.7, you don't need to enable `mod_filter`

# and can remove the `` and `` lines

# as `AddOutputFilterByType` is still in the core directives).

AddOutputFilterByType DEFLATE "application/atom+xml" \

"application/javascript" \

"application/json" \

"application/ld+json" \

"application/manifest+json" \

"application/rdf+xml" \

"application/rss+xml" \

"application/schema+json" \

"application/vnd.geo+json" \

"application/vnd.ms-fontobject" \

"application/x-font-ttf" \

"application/x-javascript" \

"application/x-web-app-manifest+json" \

"application/xhtml+xml" \

"application/xml" \

"font/eot" \

"font/opentype" \

"image/bmp" \

"image/svg+xml" \

"image/vnd.microsoft.icon" \

"image/x-icon" \

"text/cache-manifest" \

"text/css" \

"text/html" \

"text/javascript" \

"text/plain" \

"text/vcard" \

"text/vnd.rim.location.xloc" \

"text/vtt" \

"text/x-component" \

"text/x-cross-domain-policy" \

"text/xml"

# ------------------------------------------------------------------------------

# | Expires headers (for better cache control) |

# ------------------------------------------------------------------------------

ExpiresActive on

ExpiresDefault "access plus 1 month"

# CSS

ExpiresByType text/css "access plus 1 year"

# Data interchange

ExpiresByType application/json "access plus 0 seconds"

ExpiresByType application/xml "access plus 0 seconds"

ExpiresByType text/xml "access plus 0 seconds"

# Favicon (cannot be renamed!)

ExpiresByType image/x-icon "access plus 1 week"

# HTML components (HTCs)

ExpiresByType text/x-component "access plus 1 month"

# HTML

ExpiresByType text/html "access plus 0 seconds"

# JavaScript

ExpiresByType application/javascript "access plus 1 year"

# Manifest files

ExpiresByType application/x-web-app-manifest+json "access plus 0 seconds"

ExpiresByType text/cache-manifest "access plus 0 seconds"

# Media

ExpiresByType audio/ogg "access plus 1 month"

ExpiresByType image/gif "access plus 1 month"

ExpiresByType image/jpeg "access plus 1 month"

ExpiresByType image/png "access plus 1 month"

ExpiresByType video/mp4 "access plus 1 month"

ExpiresByType video/ogg "access plus 1 month"

ExpiresByType video/webm "access plus 1 month"

# Web feeds

ExpiresByType application/atom+xml "access plus 1 hour"

ExpiresByType application/rss+xml "access plus 1 hour"

# Web fonts

ExpiresByType application/font-woff "access plus 1 month"

ExpiresByType application/font-woff2 "access plus 1 month"

ExpiresByType application/vnd.ms-fontobject "access plus 1 month"

ExpiresByType application/x-font-ttf "access plus 1 month"

ExpiresByType font/opentype "access plus 1 month"

ExpiresByType image/svg+xml "access plus 1 month"

RewriteEngine On

RewriteBase /

RewriteCond %{REQUEST_METHOD} !POST

RewriteCond %{QUERY_STRING} ^$

RewriteCond %{HTTP:Cookie} !^.*(wordpress_logged_in).*$

RewriteCond %{REQUEST_URI} !^/wp-content/cache/swift-performance/([^/]*)/assetproxy

RewriteCond /home/escomser/public_html/wp-content/cache/swift-performance/%{HTTP_HOST}%{REQUEST_URI}/desktop/unauthenticated/index.html -f

RewriteRule (.*) wp-content/cache/swift-performance/%{HTTP_HOST}%{REQUEST_URI}/desktop/unauthenticated/index.html [L]

# ----------------------------------------------------------------------

# CORS-enabled images (@crossorigin)

# ----------------------------------------------------------------------

# Send CORS headers if browsers request them; enabled by default for images.

# developer.mozilla.org/en/CORS_Enabled_Image

# blog.chromium.org/2011/07/using-cross-domain-images-in-webgl-and.html

# hacks.mozilla.org/2011/11/using-cors-to-load-webgl-textures-from-cross-domain-images/

# wiki.mozilla.org/Security/Reviews/crossoriginAttribute

# mod_headers, y u no match by Content-Type?!

SetEnvIf Origin ":" IS_CORS

Header set Access-Control-Allow-Origin "*" env=IS_CORS

# ----------------------------------------------------------------------

# Webfont access

# ----------------------------------------------------------------------

# Allow access from all domains for webfonts.

# Alternatively you could only whitelist your

# subdomains like "subdomain.example.com".

Header set Access-Control-Allow-Origin "*"

###END Swift Performance###

# BEGIN WordPress

Options -MultiViews

#RewriteRule ^/bsb/index\.php$ - [L]

RewriteEngine On

RewriteBase /

RewriteRule ^index\.php$ - [L]

RewriteCond %{REQUEST_FILENAME} !-f

RewriteCond %{REQUEST_FILENAME} !-d

RewriteCond %{REQUEST_URI} !^/bsb [NC]

RewriteRule . /index.php [L]

# END WordPress

Есть htaccess в внутренней папке с стандартной basic auth

При переходе в защищённую папку - ошибка 404.

но,стоит убрать из родительского htaccess строку RewriteRule . /index.php [L] аутентификации исправно работает.

Нужно подружить аутентификации на внутреннюю папку в вп с самим вп.