Password protection for files to be downloaded

[ACDII]

I have ISPConfig installed on a server, and run several websites off of it, some fully password protected, a couple not at all. One of them is our main website, which doesn't need password protection, except for a couple files that customers download. I want to password protect those files only for this site.

Is there a way to protect just the files, or do I move them to a separate directory and setup .htaccess for just that directory?

[chipsafts]

I would definitely setup a different directory.