400 Bad Request: what it means and what to do
A 400 is the server saying the request itself is broken. Under the official definition in RFC 9110, the server cannot or will not process the request because of a perceived client error, such as malformed request syntax, invalid message framing, or deceptive request routing. It is the most generic of the 4xx codes, which is why it shows up for everything from a corrupted cookie to a badly formed API call.
If you are just visiting a site
- Refresh the page. A one-off glitch in how the request was assembled can clear on a clean retry.
- Check the address for stray characters. Long links copied from email or chat sometimes gain extra characters, spaces, or a truncated tail, and the server rejects the mangled URL.
- Clear the site's cookies. A corrupted or oversized cookie is a classic cause of a sudden 400 on a site that worked yesterday. Clear cookies for that site only, then sign in again.
- Uploading a file? Check its size and name. Files that exceed the server's limit, or filenames with unusual characters, are often rejected with a 400.
- Try a different browser or a private window. If the error disappears, the cause is something stored in your usual browser, usually a cookie or a cached request.
If it is your site or your API
- Read the server and application logs at the exact timestamp. Frameworks usually log the specific validation failure behind the generic 400, such as a missing field, a wrong content type, or an oversized header.
- Check header and cookie size limits. Proxies like nginx reject requests with oversized cookies or headers (the large_client_header_buffers limit) and surface a 400.
- Validate what changed recently. A new form field, a stricter validation library, or a WAF rule added this week often explains a sudden wave of 400s.
- For APIs, return a useful body. A bare 400 tells the caller nothing. Naming the field and the problem in the response body saves everyone a round trip.
Visitors: a 400 is about the request, not your device or your account, and no repair tool changes it. Owners: the generic message is deliberate, the specific reason is in your logs.
Common questions
Is a 400 error my fault? Sort of, but usually not in a way you chose. It means something in the request your browser or app sent was malformed or unacceptable to the server. A stale cookie or a mangled link is enough, and both fix themselves with the steps above.
What is the difference between 400 and 422? A 400 says the request could not be understood or was structurally wrong. A 422 says the request was well formed and understood, but the content failed semantic validation, such as a correctly formatted email address that is already taken.
Related errors