Only use this if you are an advanced user.
If you want complete protection of a folder in WordPress, you need to edit the htaccess file in your public_html folder and change the bold line below:
# BEGIN WordPress
RewriteEngine On
RewriteBase /
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule . /index.php [L]
# END WordPress
to
RewriteRule ./ /index.php [L]
Once this rewrite rule is modified, the password protection of the internal folder should be working as expected. Make sure you clear the cache of your browser and check the modifications on your end.