400 Bad Request: Causes and How to Fix It

Applies to: any website; server messages tested with Nginx 1.31.6, Apache 2.4.68 and the WordPress 7.1.2 REST API

400 Bad Request means the server refused the request because something in it looks wrong: the address, the headers, the cookies or the data sent. The error comes before the website’s own code runs, so the page itself is usually fine.

Quick fixes for visitors

1. Check the address for typing errors, stray characters or a half-copied link.
2. Delete the cookies for that site. Oversized or broken cookies are the most common cause (see below).
3. Clear the cache: clear your browser cache, or try a private window.
4. If it happens while uploading a file, the file may be too large; that usually shows as a separate error, 413.

The messages we reproduced

• Nginx: 400 Request Header Or Cookie Too Large (the page title; the page itself says 400 Bad Request) when we sent a 9 KB cookie. Nginx’s default header buffer (large_client_header_buffers 4 8k) is 8 KB per header line.
• Nginx: 400 The plain HTTP request was sent to HTTPS port when we used http:// on port 443. This also happens when a proxy or load balancer forwards plain HTTP to the SSL port.
• Apache: Your browser sent a request that this server could not understand. Size of a request header field exceeds server limit. for the same large cookie (Apache’s LimitRequestFieldSize defaults to 8190 bytes).
• APIs: the WordPress REST API answered 400 with rest_invalid_param and per_page is not of type integer. when we sent text instead of a number. APIs put the reason in the response body.

Fixes for site owners

• Find the big cookie: in the browser’s developer tools (F12) open Application (Chrome, Edge) or Storage (Firefox) › Cookies. Plugins, analytics or A/B testing tools that store data in cookies are the usual cause; fix them rather than the limit.
• Raise the limit only if you need to. In Nginx, the directive is allowed in the http or server block, not in a location (Nginx refuses to start otherwise):

  large_client_header_buffers 4 16k;

  With this setting, our 9 KB cookie was accepted (200). In Apache: LimitRequestFieldSize 16380.
• Plain HTTP to the HTTPS port: correct the link or proxy so that https:// is used for port 443.
• API errors: log the response body; it names the field or value that is wrong.

Other errors: 403 Forbidden and 500 Internal Server Error.