You can password protect a whole directory using apache user authentication. Look the apache docs for more info. There's a useful article here which gives some easier to digest info.
If you want to restrict access to your phplist files, I would recommend that approach if you don't have a lot of users....like if you just want you and your buddies to be able to administrate your phplist stuff.
If, on the other hand, you have a big list of users in a database and want phplist to manage them, then you would need take a different approach.
Perhaps you could tell us more about what you are trying to do? Would you have a situation where some new user you had never met would sign up and need access to this folder?
