The .htaccess file should be created in the directory you which to protect. This could be your entire comhtml directory, or a subdirectory of your comhtml directory. Once a .htaccess file has been placed in a directory, everything in that directory (including all subdirectories and their contents) will be protected.
The .htaccess file contains the instructions for determining who is allowed to access the directory. There are two sections of the .htaccess file: