400 Bad Request
Web/HTTP
Low severity
HTTP 400 — Bad Request
The server rejected the request as malformed — commonly an oversized or corrupt cookie, a bad URL, or an invalid header.
Last reviewed 2026-08-29 by the Tech Issue Guide team.
Symptoms
- A page or API call returns “400 Bad Request.”
- Only one site is affected; others load fine.
- It started after being logged in a long time or after a site update.
What causes 400 Bad Request
- A large or corrupted cookie for that domain exceeds the server’s header-size limit.
- A malformed URL — stray characters, bad percent-encoding, an over-long query string.
- An invalid request header or JSON body when calling an API.
- A browser extension injecting bad headers.
How to fix it — 3 steps
- Clear cookies and site data for that specific domain (browser Settings → Privacy → Site data), then reload.
- Check the URL for typos and stray characters; open the site in a private window with extensions disabled.
- If you are calling an API, validate the JSON body, the Content-Type and Authorization headers, and the query parameters.
Terminal / CLI command
curl -v "https://example.com/"The verbose output shows the exact request line and headers being sent — useful for spotting a malformed request.
How to confirm the fix: The page loads or the API returns 200 after clearing cookies or correcting the request.
Prevent it from coming back
Keep request URLs and headers within limits, and periodically clear cookies for sites you keep signed into.
Frequently asked questions
Is a 400 my fault or the server’s?
By definition it is the client request the server could not understand — but a buggy site can also send bad requests from its own front-end code. Clearing cookies fixes the most common real-world case.