I just tested on my copy and got it to work, but I'm on nginx. I'm sure it's possible with Apache though.

I'm assuming you tried putting something like this in your root .htaccess file (the one that you renamed from htaccess-dist on installation)?

  <Directory "/private-page">
    AuthType Basic
    AuthName "Restricted Area"
    AuthUserFile /.htpasswd
    Require valid-user
  </Directory>

Then you have the .htpasswd file alongside that or in a subdirectory, which contains the username and hashed password.

If that doesn't help, make an issue on my repo and we can work it out there. Today I added password protected pages as a built-in feature, but it would need much longer in the oven before I could suggest switching an existing site over.

https://github.com/ch-rs/hotglue2