RewriteEngine On
RewriteCond %{SERVER_PORT} !443
RewriteRule (.*) https://%{HTTP_HOST}%{REQUEST_URI} [R=301,L]
AuthType Basic
AuthName "Restricted Area"
AuthUserFile /path/to/your/.htpasswd
Allow from env=!HTTPS # Allow access for non-HTTPS users.
Require valid-user # Require basic auth for everyone else.
https://stackoverflow.com/questions/10267102/apache-htaccess-redirect-to-https-before-asking-for-user-authentication
Apache .htaccess redirect to HTTPS before asking for user authentication - Stack Overflow