We have a .htaccess file in a folder configured with deny,allow as follows:
Order deny,allow Deny from all Allow from <whitelist IP> Allow from <whitelist IP> ....
There are no other rewrite etc. rules in this file, just the deny/allow stuff.
If you attempt to go to http://www.xyz.site/protected/ (no filename) from a denied IP, you get the Forbidden error as expected. If, however, you go to http://www.xyz.site/protected/filename.php - where filename.php is a valid file inside the folder, e.g. the login form, the page loads - but with no images or CSS (presumably still denied per the .htaccess)
Why isn't this .htaccess setup preventing access to the whole folder from denied IPs - might there be a conflicting server permission somewhere overriding it?