I found a problem in the way the .htaccess file for webstats is generated. A user of ours is running Drupal 6 and has Webalizer stats. Accessing domain.com/stats/ on his site yields a 403 error while domain.com/stats/index.html works. This is due to Drupal6's .htaccess in the document root that specifies DirectoryIndex index.php which is automatically active for subdirectories as well, so it works for awstats but not Webalizer. Thus, I think the autogenerated .htaccess file should explicitly specify the two choices. I've attached an untested but trivial enough patch against 18.104.22.168 that adds this and also fixes incorrect permissions for the .htaccess and .htpasswd_stats files -- they are not executable and shouldn't be marked as such, so the mode is 0644 instead of 0755.