Here's a recipe for awstats using mod_rewrite. The page is protected by an access control list allowing access from a specific network, as well as asking for a username and password if you try to access from elsewhere.

Place this within your virtualhost(s), and go to http://yoursite.example.com/stats.

  ## Enable rewriting
  RewriteEngine On

  ## Rewrite matching URLs
  RewriteRule /awstats-icon(.*) /usr/share/awstats/icon/$1 [last]
  RewriteRule /stats(.*) /usr/lib/cgi-bin/awstats.pl$1 [last]

  ## Restrict access to awstats
  <Location /stats>
    SetHandler cgi-script
    Order deny,allow
    Deny from all
    Allow from 192.0.2.0/24
    AuthName "Lies, damn lies and statistics"
    AuthType basic
    AuthUserFile /etc/apache2/passwd
    Require valid-user
    Satisfy any
  </Location>

(Note: The paths used here are from the Debian/Ubuntu package)