QUESTION How to protect a test installation via htpasswd?

[Felix]

What do you mean by "goes inside a folder" and "put it above the web root"?

The web root is the level in your hosting tree from where the internet has access to your files (e.g. your website)
For security reasons the .htpasswd file should never be in the web root but always above the web root.
Check with your CPanel or your FTP if you can access folders above the web root or contact your hoster support about this