This can happen if you have an embedded mp3 file or other audio files etc. The audio player needs the username and password also. To fix this, you will need to tweak your .htaccess file. Here is an example to prevent password protection for .mp3 file or other audio files. It only protects certain files like .html, .php3 etc. People will only be able to access the unprotected .mp3 file if they know the full path or URL to the file: