A 400 means the server looked at the request and decided it was wrong before even trying to handle it. For a visitor using a browser, the most common cause is a cookie that's too large or corrupted: clearing cookies for that site usually fixes it. For forms and apps, it means the data sent doesn't match what the server expects, such as a missing field, the wrong format, or a file that's too big.
What's the problem
A page, form or app shows "400 Bad Request", sometimes with "Request Header Or Cookie Too Large". It may only happen for some people, or only on one form or API call.
Why it happens
- Cookies too large or corrupted. Sites that store a lot in cookies can exceed the server's header size limit.
- A malformed URL, for example with invalid characters or a broken link.
- Form or API data in the wrong format: missing required fields, invalid JSON, wrong data types.
- A file upload larger than the server allows.
- A mismatch after an update: the app's front end sends data in an old format the new back end rejects.
How to fix it
- If you're a visitor: clear cookies for that site, or try a private window.
- If many visitors see it: check what your site stores in cookies and reduce it, or raise the server's header size limit.
- For forms and APIs: read the response body. Many servers say which field is wrong.
- Check your server or app logs for the rejected request and the reason.
- If it began after a deploy, check the front end and back end agree on the data format.
- For uploads, check the size limits on the web server and the app. See file upload failing.
What Preventionlabs checks
One click runs the full report on your domain. For this problem it shows whether your site loads, how fast, and where its redirects go; up to 50 pages from your sitemap, listing any that fail or are slow, plus broken links on them. With Cloudflare connected, it also shows which pages returned server errors (5xx) to visitors, and when; which requests the firewall blocked, by Cloudflare's own rule names; recent deploys and account changes, with their times.
Run your free reportYour first report is free, no card needed. Then A$50 a month, up to 10 domains. Read-only: it never changes anything.
Sources
- MDN Web Docs: 400 Bad Requestreference
The HTTP 400 Bad Request client error response status code indicates that the server would not process the request due to something the server considered to be a client error.