A 400 Bad Request is an HTTP status code that means the server received your request but refused to process it because something about the request was wrong. That could be a mistyped URL, corrupted cookies, an oversized upload, invalid JSON sent to an API or headers that are too large. You will find what the error means, the different messages you might see, and step by step fixes for Chrome, Google sites, Android, REST APIs and the server itself. Our team runs into these errors every week while building and maintaining WordPress and Laravel sites, so the fixes below are the ones we actually use.
Quick answer: A 400 Bad Request error means the server could not understand or would not accept your request because of a client-side problem. For visitors, the fastest fixes are checking the URL, clearing cookies for that site, clearing the cache and trying an incognito window. For developers, check the request body format, Content-Type header, required parameters and server header size limits.
Table of Contents
What Does 400 Bad Request Mean?
The 400 Bad Request status code tells you the server thinks the client made a mistake. According to RFC 9110, the server cannot or will not process the request because of something perceived as a client error, such as malformed syntax, invalid message framing or deceptive request routing. The problem sits with the request, not the server crashing.
400 Bad Request vs Other 4xx Errors
The 400 code is a general “your request is wrong” response. Other 4xx codes are more specific, and knowing the difference saves time when you troubleshoot.
| Code | Name | What it usually means |
|---|---|---|
| 400 | Bad Request | Malformed request, invalid data or bad headers |
| 401 | Unauthorized | Missing or invalid login credentials or token |
| 403 | Forbidden | You are identified but not allowed to access it |
| 404 | Not Found | The URL does not exist on the server |
| 405 | Method Not Allowed | Wrong HTTP method, such as GET instead of POST |
| 408 | Request Timeout | The client took too long to send the request |
| 413 | Content Too Large | The upload or request body is too big |
| 414 | URI Too Long | The URL is longer than the server accepts |
| 431 | Request Header Fields Too Large | Headers or cookies exceed the server limit |
If you see a 5xx code instead, the server itself failed. Our guide to the 502 bad gateway error covers that side of the problem.
Common Versions of the Error Message
The same status code shows up with different wording depending on the browser, web server or platform. These are the versions people search for most:
- 400 Bad Request with nothing else, common on Nginx servers.
- Bad Request. Your browser sent a request that this server could not understand. This is the default Apache message.
- 400. That’s an error. Your client has issued a malformed or illegal request. This is the Google version seen on Gmail, YouTube and Drive.
- 400 Bad Request. Request Header Or Cookie Too Large. An Nginx message caused by oversized cookies.
- Request failed with status code 400. The message Axios and many JavaScript apps throw.
- HTTP Error 400. The request hostname is invalid. An IIS message when the host header does not match.
What Causes a 400 Bad Request Error
A 400 Bad Request error almost always comes from the request itself. On the visitor side, the usual suspects are broken URLs, stale cookies and cached data. On the developer side, it is usually invalid request bodies, missing fields or headers that break server limits. Find which side you are on first.
Causes on the Browser Side
- Malformed URL: a typo, a stray percent sign or characters that are not encoded properly.
- Corrupted or oversized cookies: old session cookies that conflict with a new login or grow too large.
- Stale browser cache: cached files that no longer match what the server expects.
- Browser extensions: ad blockers or privacy tools that rewrite headers.
- Outdated DNS cache: your device points to an old server address.
- Large file uploads: files bigger than the site allows, which some servers report as 400 rather than 413.
Causes on the Server and Application Side
- Invalid JSON or form data: a missing bracket, trailing comma or wrong data type.
- Missing required parameters: the API expects a field that the request did not send.
- Wrong Content-Type header: sending JSON while the header says form data.
- Header size limits: Nginx, Apache and IIS all cap header size, and large cookies or tokens can cross that cap.
- Validation rules: the application rejects values outside the accepted format, such as a badly formatted email or date.
How to Fix 400 Bad Request in Chrome and Other Browsers
If you hit a 400 Bad Request while browsing, work through these fixes in order. Most people solve it in the first three steps. The same steps work in Chrome, Edge, Firefox and Safari, though the menu names differ slightly. Test the page again after each step so you know which change fixed it.
Check the URL for Typos
Look closely at the address bar. Remove extra characters, spaces and stray symbols such as %, { or }. If you copied the link from an email or chat app, it may have been cut off or double encoded. Try going to the homepage and click through to the page manually.
Clear Cookies for That Site
This is the fix that works most often. In Chrome, click the icon on the left of the address bar, open Site settings and delete data for that site, or follow Google’s guide to clearing cache and cookies in Chrome. Clearing cookies for one site is better than clearing everything, because you stay logged in elsewhere.
Clear the Cache and Hard Reload
Press Ctrl + Shift + R on Windows or Cmd + Shift + R on Mac to reload without the cache. If that fails, clear cached images and files from the browser settings for the last 24 hours or all time.
Try an Incognito Window and Disable Extensions
Open the page in an incognito or private window. If it loads, an extension or stored data is the cause. Turn extensions off one at a time until the page works again.
Flush Your DNS Cache
An old DNS record can send requests to the wrong server. Run one of these commands, then restart the browser:
Windows: ipconfig /flushdns
macOS: sudo dscacheutil -flushcache; sudo killall -HUP mDNSResponder
Chrome: visit chrome://net-internals/#dns and click Clear host cacheReduce the File Size You Are Uploading
If the error appears when you upload, compress the image or video and try again. If a smaller file works, the site has an upload limit, and the site owner needs to raise it.
Fixing “400. That’s an Error” on Google Sites
Google shows its own version of the 400 Bad Request page on Gmail, YouTube, Google Drive and Google Docs. The message says your client has issued a malformed or illegal request. It is almost always caused by corrupted Google cookies, a broken link or an account session conflict between several signed-in Google accounts.
Steps That Usually Work
- Sign out of all Google accounts, close the browser and sign back in.
- Delete cookies for google.com and youtube.com only.
- Open the link in an incognito window to rule out extensions.
- Check that the link is complete if someone shared it with you.
- Update Chrome to the latest version from Settings and About Chrome.
When the Problem Is on One Account
If the error only shows on one Google account, open the same page while signed in to just that account. Multiple sessions in one browser profile often cause conflicts. Using separate Chrome profiles for work and personal accounts stops it from happening again.
400 Bad Request in REST APIs and App Requests
In APIs, a 400 Bad Request means your code sent something the endpoint will not accept. The response body usually tells you exactly what is wrong, so read it before changing anything. We see this daily when connecting payment gateways, CRMs and headless WordPress builds through the REST API.
Common API Causes and Fixes
| Cause | Example | Fix |
|---|---|---|
| Malformed JSON | Trailing comma or single quotes | Validate the body with JSON.stringify or a linter |
| Wrong Content-Type | Sending JSON without application/json | Set the header to match the body |
| Missing required field | No email in a signup request | Check the API docs for required fields |
| Wrong data type | A string where a number is expected | Cast values before sending |
| Bad query string | Spaces or symbols not encoded | Use encodeURIComponent on values |
| Invalid token format | Bearer token with extra spaces | Trim and format the Authorization header |
Example of a Malformed JSON Request
This request fails because of the trailing comma and single quotes:
POST /wp-json/wp/v2/posts
Content-Type: application/json
{ 'title': 'Hello', 'status': 'draft', }The corrected version uses double quotes and no trailing comma:
{ "title": "Hello", "status": "draft" }Reading “Request Failed With Status Code 400”
x without the server’s explanation in the message itself. Log error.response.data to see the real reason. With fetch, the promise does not reject on a 400, so check response.ok and read response.json(). When we built a Stripe API integration in Python for a client, every 400 response included a clear param field that pointed to the exact problem.
How Developers Fix 400 Bad Request on the Server
When many users report a 400 Bad Request at once, the cause is often a server limit or an application rule. Check your server error logs first, since they record the exact reason. Then review header limits, upload limits, firewall rules and any recent plugin or code change that touched cookies or forms.
Raise Nginx Header Buffer Limits
The “Request Header Or Cookie Too Large” message comes from Nginx. The large_client_header_buffers directive controls the limit:
http {
large_client_header_buffers 4 16k;
}Reload Nginx after the change. Raising the limit helps, but also find out why the cookies grew so large in the first place.
Adjust Apache Request Limits
Apache uses LimitRequestFieldSize to cap the size of each header. The default is 8190 bytes. Increase it carefully in your server config if large tokens are legitimate.
Check WordPress Plugins, Firewalls and Forms
On WordPress sites, 400 errors often come from security plugins, web application firewalls, caching rules or form plugins that reject unexpected fields. Disable recently added plugins on a staging site to find the culprit. A CAPTCHA script can also block form submissions, and our guide on how to disable reCAPTCHA shows how to test without it. Cheap shared hosting tends to have tighter limits, which is one reason we recommend the WordPress hosting providers for agencies on our list.
Return Helpful Error Messages
If you build APIs, return a clear error body with each 400 response. The RFC 9457 problem details format gives you a standard JSON structure with a type, title and detail field. Clear messages save your users and your support team hours.
Fixing 400 Bad Request on Android and Mobile Apps
On Android, a 400 Bad Request usually appears in Chrome, the YouTube app or other apps that talk to an API. The cause is similar to desktop: stale app data, a bad link or a network setting. Clearing the app cache solves most cases without losing your account data.
Steps for Android Phones
- Open Settings, then Apps, pick the app and tap Storage, then Clear cache.
- In Chrome for Android, open Settings, then Privacy and security, and clear cookies and site data.
- Update the app from the Google Play Store.
- Switch between Wi-Fi and mobile data to rule out a network proxy.
- Restart the phone and test again.
When the App Itself Is Broken
If the error only appears in one app and clearing data does not help, the app may be sending bad requests after an update. Check the app’s reviews or support page for an outage report, and wait for a fix.
FAQs
These are the questions people ask most often about the 400 Bad Request error.
What does 400 Bad Request mean?
A 400 Bad Request means the server received your request but refused to process it because something in the request looks wrong. It could be a broken URL, corrupted cookies, invalid data or headers that are too large. The status code points to a client-side problem rather than a server crash. Clearing cookies for the site and checking the URL fixes most cases for regular visitors.
How do I fix a 400 Bad Request error in Chrome?
Start by checking the URL for typos and stray characters. Then delete cookies for that one site through Site settings and do a hard reload with Ctrl + Shift + R. If the page still fails, try an incognito window and disable extensions one by one. Flushing your DNS cache and updating Chrome solves the remaining cases, unless the website itself has a problem.
Is a 400 error my fault or the website’s fault?
Technically, a 400 code says the request was the problem, so it often starts on your side with cookies, cache or a bad link. But the website can trigger it too, for example when a plugin creates oversized cookies or a form rejects valid input. If clearing your data and trying another browser does not help, contact the site owner and include the exact error message.
What does “400. That’s an error” mean on Google?
This is Google’s version of the 400 Bad Request page. It says your client has issued a malformed or illegal request. It usually happens on Gmail, YouTube or Google Drive because of corrupted Google cookies, a broken shared link or conflicts between several signed-in accounts. Sign out of all accounts, delete Google cookies and sign back in to fix it.
What does “your browser sent a request that this server could not understand” mean?
This is the default 400 Bad Request message from Apache web servers. It means the server could not parse the request your browser sent. Common causes are malformed URLs, oversized cookies or a header that breaks the server limit. Clear cookies for the site and try again. If you own the server, check the Apache error log for the exact reason.
Why do I get “request failed with status code 400” in my app?
This message comes from Axios or similar JavaScript HTTP libraries, and it means the API rejected your request as invalid without showing the reason in the message itself. Log error.response.data to see the server’s explanation, which usually names the missing or invalid field. Then check the JSON body, the Content-Type header and the required parameters in the API documentation before sending the request again.
What is the difference between a 400 and a 404 error?
A 400 Bad Request means the server understood that you asked for something but the request itself was malformed or invalid. A 404 Not Found means the request was valid but the page does not exist at that URL. In short, 400 is a problem with how you asked, while 404 is a problem with what you asked for. Each one needs a different fix.
Can a 400 Bad Request error hurt SEO?
Yes, if search engines hit it on important pages. Googlebot will not index a URL that returns a 400 status, and the page can drop out of search results. Check the Pages report in Google Search Console for URLs with 4xx errors, fix the cause and request indexing again. Regular site monitoring and a quick check after every plugin update catch these errors before rankings suffer.
How do I fix a 400 Bad Request on Android?
Open Settings, go to Apps, choose the app and clear its cache. For Chrome on Android, clear cookies and site data from Privacy and security settings. Update the app from the Play Store, switch between Wi-Fi and mobile data and restart the phone. If only one app fails after an update, the app may need a fix from its developer, so check its support page for known issues.
Conclusion
A 400 Bad Request looks alarming, but the fix is usually simple once you know where to look. For visitors, check the URL, clear cookies for the site, hard reload and test in an incognito window. For Google sites, sign out of every account and clear Google cookies. For developers, read the response body, validate the JSON, match the Content-Type header and check server header and upload limits.
Hannah’s checkout issue came down to one bloated cookie, and that is typical. Most 400 errors trace back to a single bad value in the request. If your site keeps throwing 400 errors after these fixes, check your server logs and any plugin that touches cookies, forms or security rules. The MDN reference for the 400 status code is a good bookmark for your team, and so is your hosting control panel, where the raw error logs live. Which version of the 400 error are you seeing right now?
