htaccess Block access to directory with two exceptions

view story

http://serverfault.com – I can't figure out how to write an .htaccess file which blocks all access to a directory except for reading html files, which sould be allowed and php-files which require athentication. Denying all access and allowing html works fine but asking for a password for php-files doesn't. Here is what I came up with: <FilesMatch ".*\.php$"> AuthName "Test area" AuthUserFile /var/www/.htpasswd AuthType Basic require valid-user </FilesMatch> <FilesMatch "\.html?$"> Order Allow,Deny Allow from All </FilesMatch> order Allow,Den (HowTos)