diff --git a/src/node/routes/login.ts b/src/node/routes/login.ts
index b1cd34b9b..3ec339c15 100644
--- a/src/node/routes/login.ts
+++ b/src/node/routes/login.ts
@@ -59,10 +59,6 @@ router.get("/", async (req, res) => {
 
 router.post("/", async (req, res) => {
   try {
-    if (!limiter.try()) {
-      throw new Error("Login rate limited!")
-    }
-
     if (!req.body.password) {
       throw new Error("Missing password")
     }
@@ -84,6 +80,12 @@ router.post("/", async (req, res) => {
       return redirect(req, res, to, { to: undefined })
     }
 
+    // Note: successful logins should not count against the RateLimiter
+    // which is why this logic must come after the successful login logic
+    if (!limiter.try()) {
+      throw new Error("Login rate limited!")
+    }
+
     console.error(
       "Failed login attempt",
       JSON.stringify({