I have read how to protect admin folder with .htaccess and .htpasswd file but in PyroCMS admin login (ex:
example.com/admin) just only routing system (no admin folder yet).
So, how can I double protect my admin access?
The reason your not seeing admin directory is because the URL's are generated using the SQL/CMS and physical paths do not actually exist. You can however make a folder called admin and then stick the htaccess file into to there and it should work without problems.
You can limit the access to the admin with the htaccess to your IP, however, if you have a dynamic IP you might lock yourself out.
To do this place a .htaccess in your admin folder and put the following lines in
order deny,allow allow from 220.127.116.11 (replace with your IP address) deny from all