diff --git a/CHANGELOG.md b/CHANGELOG.md
index ea1434b7..76fec75b 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -17,6 +17,13 @@ See also the [v0.107.66 GitHub milestone][ms-v0.107.66].
 
 NOTE: Add new changes BELOW THIS COMMENT.
 -->
+
+### Fixed
+
+- Authentication errors in the Web UI when AdGuard Home is behind a proxy that sets Basic Auth headers ([#7987]).
+
+[#7987]: https://github.com/AdguardTeam/AdGuardHome/issues/7987
+
 <!--
 NOTE: Add new changes ABOVE THIS COMMENT.
 -->
diff --git a/internal/home/authhttp.go b/internal/home/authhttp.go
index bc8e7068..349e8483 100644
--- a/internal/home/authhttp.go
+++ b/internal/home/authhttp.go
@@ -506,24 +506,21 @@ func (mw *authMiddlewareDefault) userFromRequestBasicAuth(
 		return nil, fmt.Errorf("login attempt blocked for %s", left)
 	}
 
-	rateLimiter.inc(remoteIP)
-	defer func() {
-		if err != nil {
-			return
-		}
-
-		rateLimiter.remove(remoteIP)
-	}()
-
 	user, _ = mw.users.ByLogin(ctx, aghuser.Login(login))
 	if user == nil {
+		rateLimiter.inc(remoteIP)
+
 		return nil, errInvalidLogin
 	}
 
 	ok = user.Password.Authenticate(ctx, pass)
 	if !ok {
+		rateLimiter.inc(remoteIP)
+
 		return nil, errInvalidLogin
 	}
 
+	rateLimiter.remove(remoteIP)
+
 	return user, nil
 }