# These pages are public
<FilesMatch "^(robots\.txt|errorpage\.php)$">
order allow,deny
allow from all
</FilesMatch>

# The rest of the site is private
AuthUserFile /path/to/your/.htpasswd
AuthType Basic
AuthName "Login Required"
Require valid-user
Order allow,deny
Satisfy any

# Public pages
<FilesMatch "^(robots\.txt|errorpage\.php)$">
order allow,deny
allow from all
</FilesMatch>

# Private 
AuthUserFile /path/to/your/.htpasswd
AuthType Basic
AuthName "Login Required"
Require valid-user
Order allow,deny
Satisfy any

# Public pages
<FilesMatch "^(robots\.txt|errorpage\.php)$">
order allow,deny
allow from all
</FilesMatch>

# Private 
AuthUserFile /path/your/.htpasswd
AuthType Basic
AuthName "Login Required"
Require valid-user
Order allow,deny
Satisfy any

http://www.webmasterworld.com/apache/4051548.htm

Before taking a site "live", I password protect it except the robots.txt for search engines and custom Error pages. You can adapt this to your own use and add other pages in the FilesMatch directive.

.htaccess: Password protect your entire site except certain pages

regex, htaccess

Apache