A 400 Bad Request error means a server cannot or will not process a request because it considers something in that request invalid. Possible causes include a malformed web address, oversized cookies, or incorrect form or API data.
Start by checking the URL and testing another browser. If the problem affects only one website in your usual browser, removing that site’s cookies may help. Website owners should investigate the rejected request and relevant logs.
What does 400 Bad Request mean?
When you open a page or submit a form, your browser sends a request. The website responds with an HTTP status code describing the result.
MDN’s explanation of HTTP 400 describes a request the server considers faulty. You might see “HTTP Error 400,” “Bad Request,” or “Request Header or Cookie Too Large.”
The code identifies a category of problem, not its exact cause. It also does not prove that you personally did something wrong: website code can generate an invalid request, and server settings can reject otherwise legitimate activity.
Common causes of a 400 error
Use the circumstances of the failure to decide what to investigate first.
| When the error appears | Possible cause | First check |
|---|---|---|
| After opening a copied link | Broken URL or incorrectly formatted parameters | Open the page through the website’s navigation. |
| Only in your usual browser | Cookies or other browser-specific data | Compare the same page in another browser. |
| With a cookie or header-size message | A request header exceeds the server’s limit | Remove the affected site’s cookies. |
| After submitting a form or API request | Missing, invalid or incorrectly formatted input | Read the response details and check the submitted data. |
| During a file upload | The upload exceeds a limit or violates the form’s requirements | Check the permitted size and file type. |
A request header carries information about the request, such as cookies. NGINX, for example, documents that an oversized individual header field can trigger HTTP 400. Its request-header documentation explains the relevant limit.
Upload limits can also produce 413 Content Too Large. The exact response depends on which part of the system rejects the upload, so record the actual code and message.
How to fix 400 Bad Request as a visitor
1. Check the address and reopen the page
Look for a truncated link or extra punctuation copied from a message. Open the website’s homepage and navigate to the page again.
Avoid randomly deleting parts of a checkout, password-reset or account-verification link. Its parameters may be necessary. Request a fresh link when appropriate.
2. Compare another browser
Open the same address in another browser. If it works there, investigate differences in cookies, extensions or browser settings.
This is a useful clue, not a diagnosis. The second browser may also be signed into a different account. Compare the same page and action before drawing conclusions.
3. Remove cookies for the affected website
Cookies and cached files are different. Clearing cached images alone does not remove cookies sent with requests.
To remove one website’s stored data in desktop Chrome:
- Open More → Settings.
- Select Privacy and security → Third-party cookies.
- Open See all site data and permissions.
- Search for the website’s name.
- Select Delete beside that site and confirm.
These steps follow Google’s instructions for deleting specific cookies. Removing site data may sign you out and reset preferences. Save unfinished work before proceeding, then reopen the page and sign in again if needed.
4. Check form fields and upload requirements
If the error appears after submitting a form, review the required fields and any instructions beside them.
For uploads, check the permitted file type and maximum size. If appropriate, try a smaller supported file. Changing a filename extension does not convert the file’s actual format.
Before retrying a payment or order submission, check whether it was already recorded.
5. Check browser extensions or report the problem
If another browser works, temporarily disable a suspected extension and repeat the same action. Re-enable it if the result does not change. Also install pending browser updates.
If the error continues, contact the website owner with the affected page, time, browser and action that failed. A screenshot of the message helps; exclude passwords, payment details and private account information.
How website owners can troubleshoot HTTP 400
Identify the failing request
A page can load successfully while its contact form, login or background request fails.
In desktop Chrome:
- Open Developer Tools and select Network.
- Reproduce the problem with the panel open.
- Find the request returning 400 in the Status column.
- Inspect its address, headers, submitted data and response.
Chrome’s Network panel guide explains how to inspect requests. Compare the failure time with application, web-server and proxy logs. If a firewall is involved, check its event records too.
The aim is to identify the component returning the error before changing settings.
Correct the specific request problem
For a form or API integration, check the required fields, parameter names, data types and body format against the receiving service’s documentation. An API is an interface that lets software exchange requests and responses.
Illustrative example: A form sends quantity: "many" where an endpoint requires a whole number. A service may reject that input with 400. The fix is to send a valid value and provide a clear validation message.
Invalid JSON, such as a trailing comma, is another possible cause. Use the response details to narrow the investigation rather than assuming every 400 has the same fix.
For a header-size error, investigate why cookies or other headers have grown. Ask your host to confirm the rejecting component and its limit. Raising limits without understanding the request can conceal the underlying problem.
Test WordPress changes methodically
If the issue began after a plugin, theme or integration update, record that timing and reproduce the same failure on a staging copy—a separate test version of the site.
Take a backup, then isolate the suspected change. Test plugins individually when the evidence points to a conflict. WordPress’s troubleshooting guidance recommends backups, staging and systematic checks.
Avoid disabling every production plugin or switching off the entire firewall as a first response. A targeted investigation preserves unrelated functions and makes the result easier to interpret.
After the fix, repeat the original action. Confirm that the form is received, the upload completes, or the intended account action succeeds—not merely that the error message disappears.
Can a 400 error affect SEO?
Yes, if Google receives HTTP 400 when requesting a page you want indexed. Google’s HTTP status-code guidance explains that it does not index pages returning these client-error responses and can remove previously indexed URLs.
A cookie problem affecting one visitor does not automatically mean Google encounters the same error. Check the actual response for the affected public URL and investigate relevant Search Console reports before assuming a wider indexing issue.
Frequently asked questions
Does a 400 error mean the website is down?
No. It means a component handling the request returned a rejection. Other pages or actions may still work normally.
Will clearing the cache fix a 400 error?
It may help with a browser-specific problem, but it cannot correct invalid API data or every server-side issue. For a cookie-size error, address the affected site’s cookies rather than clearing cached images alone.
Is 400 Bad Request permanent?
There is no fixed expiry time. Repeating the same invalid request usually produces the same result until the request or the condition causing its rejection changes.
What is the difference between 400 and 403?
A 400 response indicates a request the server considers invalid. A 403 response means the server understood the request but refuses to fulfil it. The HTTP specification defines these separately.
Keep important website actions working
Recurring errors can interrupt enquiries, account access and purchases. If your business website needs attention, explore HMDIA’s web design and digital marketing services or contact HMDIA to discuss the problem and appropriate next steps.
