Support

This feature adds a .htaccess and a .htapasswd file in your site's administrator directory. Every request made to any file or folder inside the administrator directory forces the browser to ask for a username and password.

In an ideal world where there are no clueless developers, the front-end and back-end of your site are completely isolated, i.e. a front-end component does not try to load any file from the administrator directory. That's security 101 for developers. That said, there are still a lot of incompetent developers without a security conscious bone in them. What they do is to reference files from the administrator directory within the front-end part of the component, e.g. CSS and Javascript files. One notorious example is Zoo. In that case, whenever you visit your site's front-end, the component will try to load one of those back-end files. The password protection .htaccess kicks in and forces the browser to ask for a username and password before delivering the file.

You can't do much about it. You can disable the password protection and ask the developer of the offending component to fix his code. That's all you can do.

It's not about the require_once. This is at the PHP level, no web server request involved. This is a safe method to include files. You have to take a look at the generated HTML. Look at the source of your front-end pages for URLs containing administrator/ and you will spot those files right away.

To the best of my knowledge, there is indeed a way to do that. Create a .htaccess file inside the folders you want unprotected (myfolder1 and myfolder2 in your example) with the following contents:

Allow from all
Satisfy Any

Do note that HTTP Authentication is an all-or-nothing approach. You either protect an entire directory and all of its subdirectories or you leave an entire directory and all of its subdirectories unprotected. If you want to create public "interfaces" to these two PHP files and nothing but those two PHP files, there's another workaround possible. First, create a directory under your public web root, e.g. "interfaces". Then, create a file named a.php with the following contents:

<?php require_once dirname(__FILE__).'/administrator/myfolder1/a.php';

Similarly create b.php etc where you just require_once the necessary file. Since the "interface" file is outside your administrator directory, it is publicly accessible.