Authentication is required and was not provided or was rejected.
WHAT IT MEANS
The server is asking for a username and password, at the server level rather than within your application.
THE USUAL CAUSE
cPanel Directory Privacy is enabled on that directory.
Check cPanel > Directory Privacy and see whether protection is active on the folder.
WHY IT MIGHT BE ENABLED
You set it deliberately, on a staging site or an admin area A developer set it and did not remove it It was enabled during development and forgotten
REMOVING IT
cPanel > Directory Privacy, select the directory, and disable password protection.
IF YOU WANT IT AND FORGOT THE PASSWORD
Create a new user in the same screen, or reset the existing one.
DIFFERENT FROM 403
403 means access is refused outright. 401 means credentials are required.
IF IT APPEARS ON YOUR WHOLE SITE UNEXPECTEDLY
Check whether protection was applied to public_html rather than to a subdirectory.
AFTER A MIGRATION
Directory Privacy settings sometimes transfer. Check if a site that was public is suddenly asking for credentials.
