diff --git a/server/index.js b/server/index.js
index 78b62dc2..5618d8ad 100644
--- a/server/index.js
+++ b/server/index.js
@@ -42,13 +42,6 @@ const app = express();
 // See: https://www.npmjs.com/package/helmet
 app.use(helmet());
 
-// Use basic authentication when not in dev mode.
-if (!dev) {
-  const USERNAME = process.env.BASIC_AUTH_USERNAME;
-  const PASSWORD = process.env.BASIC_AUTH_PASSWORD;
-  app.use(auth.basicAuth(USERNAME, PASSWORD));
-}
-
 // Redirect HTTP to HTTPS if ENFORCE_SSL is `true`.
 // This also works behind reverse proxies (load balancers) as they are for example used by Heroku.
 // In such cases, however, the TRUST_PROXY parameter has to be set (see below)
@@ -73,6 +66,13 @@ if (TRUST_PROXY === 'true') {
   app.set('trust proxy', TRUST_PROXY);
 }
 
+// Use basic authentication when not in dev mode.
+if (!dev) {
+  const USERNAME = process.env.BASIC_AUTH_USERNAME;
+  const PASSWORD = process.env.BASIC_AUTH_PASSWORD;
+  app.use(auth.basicAuth(USERNAME, PASSWORD));
+}
+
 app.use(compression());
 app.use('/static', express.static(path.join(buildPath, 'static')));
 app.use(cookieParser());