---
title: "400 Bad Request — what it means and how to fix it"
description: "The server could not understand the request because something about it is malformed. What causes an HTTP 400, what to try as a visitor, and what to check if it is your own site."
url: https://atoneplace.net/error/400/
site: "At One Place"
---

# HTTP 400 — Bad Request

**HTTP 400: Bad Request**

The server could not understand the request because something about it is malformed.

## What 400 actually means

The request itself is broken at a level the server refuses to guess about — bad syntax, a body that is not the JSON it claims to be, a header the server cannot parse, or a URL containing characters that should have been encoded. It is deliberately generic, which makes it the least helpful of the common errors: "400 Bad Request" alone tells you the server rejected the request but not which part offended it. Many APIs also use 400 for validation failures, though 422 is the more precise choice there.

## Common causes

- Malformed JSON or XML in the request body — a trailing comma is the classic
- A required field missing or of the wrong type, where the API uses 400 for validation
- Invalid or unencoded characters in the URL or query string
- A corrupted or oversized cookie the server cannot parse
- Mismatch between `Content-Type` and the body actually sent
- An HTTP request sent to a port expecting HTTPS, or vice versa

## If you're just trying to view the page

1. Clear cookies for that site — an oversized or corrupted cookie is a very common cause of a 400 that follows you around
2. Check the URL for typos, stray spaces, or characters that got mangled by copy and paste
3. Try the page in a private window or a different browser to rule out local state
4. Clear the browser cache and DNS cache if the error persists across pages on one site

## If it's your site

1. Return a body saying which field or header failed; a bare 400 wastes everyone's time
2. Validate `Content-Type` and reject mismatches explicitly rather than failing to parse
3. Check header and cookie size limits — Nginx `large_client_header_buffers` and equivalents reject oversize headers as 400
4. Use 422 for semantically valid but unacceptable data, keeping 400 for genuinely unparseable requests
5. Log the raw request when returning 400 so you can see what the client actually sent

## Reference

- **Status code:** 400
- **Reason phrase:** Bad Request
- **Category:** 4xx — Client Error
- **Defined in:** RFC 9110 §15.5.1

## Common questions

### What does HTTP 400 mean?

The server could not understand the request because something about it is malformed. The request itself is broken at a level the server refuses to guess about — bad syntax, a body that is not the JSON it claims to be, a header the server cannot parse, or a URL containing characters that should have been encoded. It is deliberately generic, which makes it the least helpful of the common errors: "400 Bad Request" alone tells you the server rejected the request but not which part offended it.

### How do I fix a 400 error?

Clear cookies for that site — an oversized or corrupted cookie is a very common cause of a 400 that follows you around

### Is 400 a client error or a server error?

400 is in the 4xx range, which means client error. The request itself was the problem, so retrying it unchanged will usually return the same code.

## Related pages

- [404 Not Found](https://atoneplace.net/error/404/)
- [403 Forbidden](https://atoneplace.net/error/403/)
- [401 Unauthorized](https://atoneplace.net/error/401/)
- [429 Too Many Requests](https://atoneplace.net/error/429/)
- [413 Content Too Large](https://atoneplace.net/error/413/)
- [422 Unprocessable Content](https://atoneplace.net/error/422/)
- [405 Method Not Allowed](https://atoneplace.net/error/405/)
- [409 Conflict](https://atoneplace.net/error/409/)
- [415 Unsupported Media Type](https://atoneplace.net/error/415/)
- [408 Request Timeout](https://atoneplace.net/error/408/)
- [410 Gone](https://atoneplace.net/error/410/)
- [451 Unavailable For Legal Reasons](https://atoneplace.net/error/451/)

## Sources

- Hypertext Transfer Protocol (HTTP) Status Code Registry — IANA (https://www.iana.org/assignments/http-status-codes/)
- RFC 9110: HTTP Semantics — IETF (https://www.rfc-editor.org/rfc/rfc9110.html)