The .htaccess file need to be in the directory that is password protected. The .htpassword can be anywhere, but you must point to it from the htpasswd
My document root is
c:\www\web\htdocs
In a directory named "private" I placed the .htaccess file, then whenever I want to access that directory it asks me for the username and password. The contents of the htaccess file I have is
allow from all
AuthType Basic
AuthUserFile d:/www/web/htdocs/private/.htpasswd
AuthName "Private area"
require valid-user
and I have the .htpasswd file in the same directory. Hope this example helps.