make sure .htaccess is world readable (644).
also, does your .htaccess look something like this:
#.htaccess file
AuthType "Basic"
AuthName "Protected Access"
AuthUserFile /home/httpd/html/secure/.htpasswd
<Limit GET>
require valid-user
</Limit>
lastly, in your httpd.conf, make sure you have this line:
AllowOverride AuthConfig