400 Status Code: Meaning and How to Fix It

HTTP status 400 means the server rejected a request because something in the request was invalid or unreadable. A 400 error usually points to a problem with the URL, browser data, headers, parameters, or information sent to the server.

What Is the 400 Status Code?

The 400 status code is an HTTP client-error response, commonly called “Bad Request.” HTTP, or Hypertext Transfer Protocol, is the set of rules browsers, apps, and servers use to exchange requests and responses.

A server returns status code 400 when it cannot understand or accept a request in its current form. The request may contain invalid syntax, unexpected characters, missing fields, conflicting headers, or data that does not match the format the server expects.

In practical terms, the answers to “what is status code 400,” “what is status 400,” and “what is HTTP status 400” are the same: the server received the request but found a basic problem before it could process it normally. An HTTP status code 400 does not identify one universal cause, so the correct fix depends on what was sent.

What Commonly Causes an HTTP 400 Error?

An HTTP status 400 response can be caused by a browser, an app, an automated API request, or information entered by a user. Common causes include:

• Malformed URL: The address contains an extra character, invalid symbol, broken parameter, or incomplete value.
• Invalid request syntax: The request line, query string, or body does not follow the format the server accepts.
• Incorrect headers: A required header is missing, duplicated, malformed, or inconsistent with the request body.
• Oversized request: The URL, headers, cookies, form submission, or uploaded data exceeds a limit enforced by the server or an intermediary.
• Corrupted cookies: Old or damaged site data causes the browser to send a value the server cannot read.
• Invalid form or API data: A field has the wrong type, required information is missing, or a JSON or XML payload is not properly formatted.

Different systems use 400 status codes differently. A response displayed as “status code: 400,” “400 status,” or “400 HTTP status” may include an additional message that narrows down the problem.

How Can a Website Visitor Fix Status Code 400?

A website visitor can often fix status code 400 by correcting the address or removing damaged site data. Try these safe steps in order:

1. Check the address for spaces, repeated punctuation, missing characters, or text added after the page name. If you typed it manually, enter it again carefully.
2. Reload the page once. If the request failed because of a temporary transfer problem, a fresh request may work.
3. Return to the website’s main page and navigate to the content again instead of reusing an old bookmark or copied address.
4. Clear cookies and stored site data only for the affected website. This may sign you out, but it avoids removing data saved by unrelated sites.
5. Try the same page in a private browsing window or another current browser. If it works there, an extension, cookie, or cached setting in the original browser may be involved.
6. Wait briefly and try again if every page on the website produces the same 400 status. A server configuration problem may require action from the website owner.

Do not repeatedly submit a form if it could create duplicate requests. If the page still fails, record the error and contact the website owner rather than entering sensitive information into unfamiliar troubleshooting tools.

How Can a Developer Fix HTTP 400?

A developer investigating a 400 HTTP status code should compare the rejected request with the endpoint’s documented format. Inspect the request without exposing passwords, session tokens, authorization headers, personal details, or complete cookies.

1. Verify the HTTP method, request target, query syntax, parameter names, and required fields.
2. Inspect headers for invalid characters, duplicate values, excessive size, and missing requirements. Confirm that authorization data is present only where expected.
3. Compare the Content-Type header with the actual payload. For example, a JSON content type requires valid JSON rather than form-encoded text.
4. Validate payload formatting, nesting, field types, and required values. Check commas, quotation marks, brackets, and empty fields.
5. Confirm that URL encoding and character encoding are correct. Reserved characters in query values may need proper percent-encoding.
6. Test whether stale or oversized cookies are causing the request to exceed a limit or fail validation.
7. Review application, proxy, gateway, and web-server logs at the matching time. Logs may show which parser, validation rule, or size limit produced status code HTTP 400.
8. Reproduce the request with non-sensitive test data, then change one part at a time to isolate the rejected value.

What is 400 status code behavior in one application may differ from another. Some servers return HTTP status code 400 for many validation failures, while others use a more specific response.

How Is Status 400 Different From Related HTTP Errors?

Status 400 means the request itself is malformed or unacceptable at a basic level. Related client-error responses identify different conditions:

• 401 Unauthorized: Authentication credentials are missing, invalid, or no longer accepted.
• 403 Forbidden: The server understood the request but refuses to permit access.
• 404 Not Found: The requested resource cannot be found at that location.
• 413 Content Too Large: The request body exceeds the server’s allowed size.
• 422 Unprocessable Content: The syntax may be valid, but the submitted data fails semantic or validation rules.

The exact choice between these responses depends on the application. The response body and server logs often provide more useful detail than the numeric 400 status alone.

When Should You Contact Website Support About a 400 Error?

Contact website support when the error continues after checking the address, reloading, clearing site-specific cookies, and trying another browser. Support may also be necessary when the error affects an important form or appears on every page of the website.

Provide the affected URL as plain text, the date and time of the error, the actions immediately before it appeared, and the browser and device used. List the troubleshooting steps already completed and include the exact error wording.

A screenshot can help, but redact account numbers, email addresses, names, form entries, tokens, cookies, and other private data first. Never send passwords, complete authorization headers, or session details. These facts give the website owner enough context to investigate what is 400 status code behavior on that system without exposing sensitive request data.