Why my WordPress Site Asking for HTTP Authentication?

Here’s what I would do. USE AT YOUR OWN RISK

  1. Back up the files and MySQL
  2. Delete mvf.php
  3. Try editing .htaccess again and see if it works.

You can also try opening the mvf.php and seeing what’s in there. You can also try installing a security plugin like WordFence to scan your site, but I’d do a full malware clean up. WordFence offers that as well if you don’t know how.