diff --git a/server/channels/api4/handlers.go b/server/channels/api4/handlers.go
index 32a96e74dc..fb4265b76c 100644
--- a/server/channels/api4/handlers.go
+++ b/server/channels/api4/handlers.go
@@ -220,6 +220,10 @@ func (api *API) APILocal(h handlerFunc, opts ...APIHandlerOption) http.Handler {
 }
 
 func (api *API) RateLimitedHandler(apiHandler http.Handler, settings model.RateLimitSettings) http.Handler {
+	if !*api.srv.Config().RateLimitSettings.Enable {
+		return apiHandler
+	}
+
 	settings.SetDefaults()
 
 	rateLimiter, err := app.NewRateLimiter(&settings, []string{})
diff --git a/server/channels/api4/user.go b/server/channels/api4/user.go
index c14198e911..ccfdbaf9dc 100644
--- a/server/channels/api4/user.go
+++ b/server/channels/api4/user.go
@@ -64,7 +64,7 @@ func (api *API) InitUser() {
 	api.BaseRoutes.User.Handle("/mfa", api.APISessionRequiredMfa(updateUserMfa)).Methods(http.MethodPut)
 	api.BaseRoutes.User.Handle("/mfa/generate", api.APISessionRequiredMfa(generateMfaSecret)).Methods(http.MethodPost)
 
-	api.BaseRoutes.Users.Handle("/login", api.APIHandler(login)).Methods(http.MethodPost)
+	api.BaseRoutes.Users.Handle("/login", api.RateLimitedHandler(api.APIHandler(login), model.RateLimitSettings{PerSec: model.NewPointer(5), MaxBurst: model.NewPointer(10)})).Methods(http.MethodPost)
 	api.BaseRoutes.Users.Handle("/login/sso/code-exchange", api.APIHandler(loginSSOCodeExchange)).Methods(http.MethodPost)
 	api.BaseRoutes.Users.Handle("/login/desktop_token", api.RateLimitedHandler(api.APIHandler(loginWithDesktopToken), model.RateLimitSettings{PerSec: model.NewPointer(2), MaxBurst: model.NewPointer(1)})).Methods(http.MethodPost)
 	api.BaseRoutes.Users.Handle("/login/switch", api.APIHandler(switchAccountType)).Methods(http.MethodPost)