diff --git a/docs/en_US/webserver.rst b/docs/en_US/webserver.rst
index 2c72dc7f2..e3e453b29 100644
--- a/docs/en_US/webserver.rst
+++ b/docs/en_US/webserver.rst
@@ -82,7 +82,11 @@ and modify the values for the following parameters:
     through Webserver authentication until you change it. To do so, sign in
     through another configured authentication source and, for each such
     user, set *Authentication source* to *webserver* on the
-    :ref:`User Management <user_management>` page.
+    :ref:`User Management <user_management>` page. If ``AUTHENTICATION_SOURCES``
+    lists only *webserver*, there is no other source to sign in with -
+    temporarily add *internal* back to ``AUTHENTICATION_SOURCES``, sign in
+    with the internal administrator's password, fix the affected users'
+    *Authentication source*, then remove *internal* again.
 
 Master Password
 ===============
diff --git a/web/pgadmin/authenticate/webserver.py b/web/pgadmin/authenticate/webserver.py
index d85e2e367..bb8c20b9f 100644
--- a/web/pgadmin/authenticate/webserver.py
+++ b/web/pgadmin/authenticate/webserver.py
@@ -158,14 +158,18 @@ def _get_header_value(name):
     controlled source. Only returned when the operator has explicitly
     opted in via WEBSERVER_REMOTE_USER_FROM_HEADER, the request came from a
     peer listed in WEBSERVER_TRUSTED_PROXIES, and (if configured) the
-    shared secret matches. Every rejection here is logged at info, not
-    warning: an unauthenticated client can trigger any of them on every
-    request, and warning-level logging would let it flood the log.
+    shared secret matches. A client-triggered rejection here (untrusted
+    peer, secret mismatch) is logged at info, since an unauthenticated
+    client can trigger it on every request and warning-level logging
+    would let it flood the log. A malformed WEBSERVER_REMOTE_USER is a
+    static operator misconfiguration, not something a client varies per
+    request, and stays at warning so it doesn't go unnoticed while every
+    login silently fails.
     """
     if not config.WEBSERVER_REMOTE_USER_FROM_HEADER:
         return None
     if not isinstance(name, str) or not name:
-        current_app.logger.info(
+        current_app.logger.warning(
             "Webserver auth: WEBSERVER_REMOTE_USER is not set to a "
             "non-empty name; rejecting the header-asserted identity.")
         return None