Rewrite rule applies to whole site

[auxlife]

I got your script to work and authenticate users/passwords/otps

but i think because the rewrite rules any page request gets send to the 2fa screen, for me to only protect folder /new/ i had to add
RewriteCond %{REQUEST_URI} ^/new/
before any of other rewrite conditions.

[itemir]

Yes, the configuration is for protecting the whole site. you can tweak the rewrite condition (as you did) to apply it to specific directories instead.