diff --git a/internal/home/authhttp.go b/internal/home/authhttp.go
index 349e8483..ff054b24 100644
--- a/internal/home/authhttp.go
+++ b/internal/home/authhttp.go
@@ -506,21 +506,25 @@ func (mw *authMiddlewareDefault) userFromRequestBasicAuth(
 		return nil, fmt.Errorf("login attempt blocked for %s", left)
 	}
 
+	defer func() {
+		if err != nil {
+			rateLimiter.inc(remoteIP)
+
+			return
+		}
+
+		rateLimiter.remove(remoteIP)
+	}()
+
 	user, _ = mw.users.ByLogin(ctx, aghuser.Login(login))
 	if user == nil {
-		rateLimiter.inc(remoteIP)
-
 		return nil, errInvalidLogin
 	}
 
 	ok = user.Password.Authenticate(ctx, pass)
 	if !ok {
-		rateLimiter.inc(remoteIP)
-
 		return nil, errInvalidLogin
 	}
 
-	rateLimiter.remove(remoteIP)
-
 	return user, nil
 }