More info on this:
I've just found the stats folder is in the filesystem:
(It is not an Alias or so in a config file as I expected.)
There is a .htaccess
file there referencing the .htpasswd_stats
AuthName "Members Only"
<limit GET PUT POST>
So it is in the client's web folder, not somewhere under /etc. It was my mistake. Now trying to figure out why it doesn't let me in...