Why does a password-protected directory ask twice for the password?

This is happening because you have a password-protected subfolder on your account. If there is a .htaccess file above the subfolder you are trying to password protect, Apache webserver is confused and asks the password for each .htaccess file it finds in it's path. In order to solve this, either move the password protection to your webroot or remove any rewrite rules / redirections.

Share the good news!