That's not enough. The problem is that a client which mistakenly sends a request to Port 80 will send the Authentication request, which, as has already been est

That's not enough. The problem is that a client which mistakenly sends a request to Port 80 will send the Authentication request, which, as has already been established, includes (basically) cleartext credentials. Even if whatever you're hosting on Port 80 returns an error, the damage is already done. To prevent that, you have to abort the connection before the client even has a chance to send the request, i.e. closing Port 80. This means that if you're going to use HTTP Basic authentication, you need to serve your API and your Website from different hosts.