Hi Rob,
I used the link you sent and tried many iterations, including enabling .htaccess override
and trying it in a .htaccess file non of them worked running httpd -M | grep auth shows
that the relevant module is enabled.
I tried changing Require all granted to Require all denied just to get it blocking all as
a first step and that still allows access.
Any other pointers?