Here's a recipe for awstats using mod_rewrite. The page is protected by an access control list allowing access from a specific network, as well as asking for a username and password if you try to access from elsewhere.
Place this within your virtualhost(s), and go to http://yoursite.example.com/stats.
## Enable rewriting
## Rewrite matching URLs
RewriteRule /awstats-icon(.*) /usr/share/awstats/icon/$1 [last]
RewriteRule /stats(.*) /usr/lib/cgi-bin/awstats.pl$1 [last]
## Restrict access to awstats
Deny from all
Allow from 192.0.2.0/24
AuthName "Lies, damn lies and statistics"
(Note: The paths used here are from the Debian/Ubuntu package)