diff --git a/CHANGELOG.md b/CHANGELOG.md
index 6f88c2f0..b94937ec 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -20,10 +20,12 @@ NOTE: Add new changes BELOW THIS COMMENT.
 
 ### Fixed
 
+- Authentication errors in the Web UI when AdGuard Home is behind a proxy that sets Basic Auth headers ([#7987]).
 - The HTTP API `GET /control/profile` endpoint failing when no users were configured ([#7985]).
 - Missing warning on the *Encryption Settings* page when using a certificate without an IP address.
 
 [#7985]: https://github.com/AdguardTeam/AdGuardHome/issues/7985
+[#7987]: https://github.com/AdguardTeam/AdGuardHome/issues/7987
 
 <!--
 NOTE: Add new changes ABOVE THIS COMMENT.
diff --git a/internal/home/authhttp.go b/internal/home/authhttp.go
index e5517933..ac3a923f 100644
--- a/internal/home/authhttp.go
+++ b/internal/home/authhttp.go
@@ -506,9 +506,10 @@ func (mw *authMiddlewareDefault) userFromRequestBasicAuth(
 		return nil, fmt.Errorf("login attempt blocked for %s", left)
 	}
 
-	rateLimiter.inc(remoteIP)
 	defer func() {
 		if err != nil {
+			rateLimiter.inc(remoteIP)
+
 			return
 		}