How secure is a .htaccess on a folder (and it's sub folders)?

[eluser]GSV Sleeper Service[/eluser]
http authentication is quick and easy, the downside is someone could fire username/password pairs at it all day long until they get a 200 back, and you'd probably never know they were doing it.

controlling authentication through CI would offer you many more options, eg capture the IP address of the user trying to login, after 3 failed attempts ban that IP etc.