HTTP 400 Bad Request

What does HTTP 400 mean?

The server cannot process the request because it is malformed. A generic client error: invalid JSON, missing required fields, a malformed header or an oversized cookie can all produce 400. APIs should return a body explaining which part of the request is wrong.

4xx Client error: The request has a problem the client can fix: wrong URL, missing credentials, bad data or too many requests.

Common causes of a 400 error

• Invalid JSON or form data sent to an API.
• Cookies or headers too large (often after many logins on one domain).
• Malformed URL encoding, such as a stray %.

How to fix 400 Bad Request

• Clear the site’s cookies and try again.
• Validate request bodies before sending; check the API error message.
• Check that query parameters are URL-encoded.

400 and SEO

Pages that return 400 to Googlebot are not indexed. Check that crawlers’ requests are not rejected by overly strict validation or WAF rules.

Example response

HTTP/1.1 400 Bad Request

How to return a 400 response

Node.js (Express)

res.status(400).json({ error: 'Bad Request' });

PHP

http_response_code(400);

Python (Flask)

return {'error': 'Bad Request'}, 400

Go (net/http)

w.WriteHeader(400)

nginx

return 400;

Related status codes

• 401 Unauthorized — Authentication is required and has failed or not been provided.
• 413 Content Too Large — The request body is larger than the server allows.
• 422 Unprocessable Content — The request is well-formed but contains semantic errors.
• 431 Request Header Fields Too Large — The request headers, or a single header, are too large.

Check which status code a URL returns with the HTTP header checker.