How to Fix 400 Bad Request Error
What the 400 Bad Request error means
HTTP status 400 is the server's way of saying "I could not understand what you asked for." Your browser reached the server without trouble, and the connection worked, but the request itself — the URL, the headers, the cookies, or the data attached to it — was malformed in some way, so the server rejected it instead of serving the page. You will see messages like "400 Bad Request," "HTTP Error 400," "400 — Bad Request: Request Header or Cookie Too Large," or a bare "Bad Request" on an otherwise empty page.
The good news is that a 400 is almost always fixable on your end, because the trigger lives in your browser or your network rather than in the website. Unlike a 404 (page not found), a 400 does not mean the content is gone — the same page will often load fine once you repair the request. And unlike a 500-level error, it is rarely the server's fault: the server is working correctly and simply refusing to process something it cannot parse. That is why the steps below start with your browser and only reach the server at the very end.
Common causes
- Broken or malformed URL: a mistyped address, a missing slash, an unencoded space, or a special character like | { } or ^ that was never percent-encoded can all make the request unreadable to the server.
- Corrupt or oversized cookies: a damaged cookie, or simply too many large cookies stored for one site, pushes the request header past the server's size limit — this is the single most common cause.
- Interfering extensions or VPNs: ad blockers, privacy extensions, and VPNs can rewrite, strip, or block the headers and cookies the site expects, and the server rejects the altered request.
- Stale DNS or network cache: outdated DNS records on your computer or router can send the request somewhere the server no longer recognizes, especially after a site changes hosts.
- Oversized uploads or bad form data: a file larger than the server's limit, a required form field left empty, or a malformed API call (wrong method, broken JSON) all come back as 400.
How to fix the 400 Bad Request error — step by step
Work through the visitor steps (1–5) in order. Step 6 is for site owners receiving 400 reports from many visitors.
- Check the URL carefully and fix any mistakes. Look at the address bar character by character. A 400 error often comes from a mistyped URL: a missing forward slash, an unencoded space, a special character like | { } or ^, or a link that got cut off when it was copied. Retype the URL manually instead of clicking the link again, and if the address is long, paste it into an online URL encoder/decoder to spot illegal characters. Special characters must be percent-encoded (spaces become %20) before the server will accept them.
- Clear the site's cookies and cached files. Corrupt or oversized cookies are the single most common cause of a 400 Bad Request. Press Ctrl + Shift + Delete, set the time range to All time, check Cookies and other site data and Cached images and files, then click Clear data. If you do not want to wipe everything, clear cookies for just the affected site: in Chrome, click the tune icon left of the address bar, open Cookies and site data, and delete the entries for that domain. Reload the page afterward.
- Test in an incognito window and disable extensions. Open the page in an incognito window (Ctrl + Shift + N). Incognito ignores your existing cookies and most extensions, so if the page loads there, the problem is a cookie or an extension in your normal window. Back in your normal window, disable all extensions, then re-enable them one at a time to find the culprit. Ad blockers, privacy extensions, and VPNs are the usual suspects, since they can rewrite or block the headers the site expects.
- Flush your DNS cache. Your computer may be working from stale DNS records that send the request to the wrong place. On Windows, open Command Prompt as administrator and run
ipconfig /flushdns, then press Enter. On a Mac, open Terminal and runsudo dscacheutil -flushcache; sudo killall -HUP mDNSResponder. Restart the browser and try the page again. This step is especially worth trying if the site recently changed hosts or the error only happens on your network. - Try another device or network. Open the same page on your phone using mobile data, or on a different browser on your computer. If it works there, the fault is isolated to your device or your network: a router cache, a firewall rule, or a misbehaving proxy. Restart your router and try again on your main connection. If the 400 appears on every device and network, the problem is with the site itself, and only the site owner can fix it — report it to them with the exact URL and a screenshot.
- Site owner: raise header limits and validate requests. If you own the site, repeated 400s from many visitors usually mean your server's header limit is too low. In Nginx, raise
large_client_header_buffers(for examplelarge_client_header_buffers 4 16k) and reload the server. In Apache, checkLimitRequestFieldSizeandLimitRequestLine. Check the server error log: it shows exactly which requests were rejected and why. If the errors come from a form or API, validate the input — a missing required field, a wrong HTTP method (POST vs GET), or malformed JSON in the request body all produce 400s, and your code should return a clear message saying which field failed.
Did this fix it? Quick checklist
- The page loads without the 400 Bad Request message
- It works in an incognito window and on another network
- Your URL has no typos or unencoded special characters
- Site owners: server logs show no further rejected requests
If the error keeps coming back for the same site every few days, that site is almost certainly storing large cookies in your browser — clear that site's cookies again and consider using a fresh profile for it. Site owners who keep seeing 400s from a single client IP should look at their firewall or WAF rules: overly strict request-filtering rules can reject legitimate visitors' headers before the request ever reaches your code.
Frequently asked questions
What does a 400 Bad Request error mean?
It means the server received your request but could not understand it — in plain English, the request was malformed. The problem is almost always on the visitor's side: a broken URL, a corrupt cookie, an oversized request header, or an interfering extension. Unlike a 404, the page itself may exist; the server simply could not process what you sent.
What does "400 Bad Request: Request Header or Cookie Too Large" mean?
It means the header block your browser sent was bigger than the server's limit — usually around 8 KB. This happens when a site has stored many large cookies in your browser over time. Clearing the cookies for that site almost always fixes it instantly. If it keeps coming back, the site owner needs to raise the server's header buffer limit, since no visitor-side fix will stick.
Why does a 400 error happen on only one website?
Because the trigger is specific to that site's data in your browser. A corrupt or oversized cookie stored for that one domain, a bookmark with a bad URL, or an extension that only acts on that site can all cause a 400 in one place while everything else works. Clear that site's cookies first, then test it in an incognito window to confirm the cause is local to your browser.
What is the difference between a 400 and a 404 error?
A 400 means the server could not understand your request because something about it was wrong, while a 404 means the request was fine but the page does not exist. Both are visitor-side 4xx errors, but the fix differs: a 400 is repaired by fixing the request (cookies, URL, headers), while a 404 is repaired by correcting the address itself.
Is a 400 Bad Request error dangerous or a security problem?
No, a 400 error itself is not dangerous and does not mean you have been hacked. It is a routine HTTP status code that simply says the request was rejected. That said, if you see 400s on sites that normally work, make sure you reached the real site and did not click a phishing link with a mangled URL, and keep your browser and extensions up to date.