HTTP 400 Bad Request — Meaning, Causes & How to Fix
The server cannot process the request due to a client error, such as malformed syntax.
- Code
- 400
- Name
- Bad Request
- Class
- 4xx Client Error
- Specification
- RFC 9110 §15.5.1
- Cacheable by default
- Only with explicit Cache-Control / Expires
What HTTP 400 means
400 Bad Request is the generic “your request is wrong” response. The server will not process it because of something the client did: malformed syntax, invalid framing, a broken header, or invalid input that does not fit a more specific 4xx code.
Common causes
- Malformed JSON or a body that does not match
Content-Type. - Oversized or corrupted cookies (“Request Header Or Cookie Too Large”).
- Invalid characters in the URL or query string.
- Missing required parameters in an API call.
How to fix it
For site owners
- Return a clear error body saying which field or header is wrong.
- Use more specific codes where they fit: 401, 403, 404, 413, 415, 422, 429.
For visitors & developers
- Clear the site’s cookies and cache, then retry.
- Check the URL for typos or stray characters.
- For APIs, validate the JSON and the
Content-Typeheader.
SEO impact
Pages that return 400 are not indexed. If Googlebot hits 400s on real URLs, look for broken URL encoding in links or a firewall rule rejecting crawler requests.
Example 400 response
HTTP/1.1 400 Bad Request
Content-Type: application/json
{"error":"invalid_json","detail":"Unexpected token at position 18"}Related status codes
Check or look up another code
Search and filter every code in the HTTP Status Codes tool, browse the full list by class, or read HTTP status codes explained: the complete developer guide.
Open HTTP Status Codes tool →All status codesFrequently asked questions
What does HTTP 400 mean?
HTTP 400 Bad Request is a 4xx Client Error status code. The server cannot process the request due to a client error, such as malformed syntax.
Is 400 a client or server problem?
It reports a client problem — but if every client gets it, the server’s validation or a proxy may be misconfigured.
What is the difference between 400 and 422?
400 is for requests that cannot be parsed or are malformed; 422 is for well-formed requests whose content is semantically invalid (for example an email field with no @).
Which specification defines 400?
It is defined in RFC 9110 §15.5.1.
Is a 400 response cacheable?
Not by default. A 400 response is only stored by caches when it carries explicit freshness information such as Cache-Control: max-age or Expires.