I also prefer not to touch core files.
I've went with a different solution that works for me.
Code:
RewriteEngine On
RewriteCond %{SERVER_PORT}80
RewriteRule ^(.*)$ https://yoursite.com/$1 [R,L]
AuthType Basic
AuthName "Access to /yoursite/"
AuthUserFile /homepages/htpasswd
Require user sdfwef4
AuthGroupFile /dev/null
SetEnvIf Request_URI .* noauth
SetEnvIf Request_URI index.php/admin/authentication/sa/login !noauth
#SetEnvIf Request_URI index.php !noauth
<RequireAny>Require env noauth
Require valid-user
</RequireAny>#change "x" to my ip & remove "#" from "deny from all"
ErrorDocument 403 http://maitanance.yoursite.com/
Order deny,allow
#Deny from all
Allow from xx.xxx.xx.xxx
#Prevent viewing of .htaccess file
<Files .htaccess>
order allow,deny
deny from all
</Files>#Prevent directory listings
Options All -Indexes
