400 Bad Request is the generic client error. The server refuses to process the request because it considers something about it wrong: malformed syntax, invalid message framing, deceptive request routing, a bad Host header, an invalid query parameter or a body that does not parse. The client should not repeat the request unchanged.
Many servers use 400 for problems that have their own, more specific codes. nginx, for example, answers "400 Bad Request: Request Header Or Cookie Too Large" when headers exceed its buffers, where 431 would be more precise, and many APIs return 400 for validation errors that could be 422.
The response body is usually the best place to find the actual reason.
Example response
HTTP/1.1 400 Bad Request
Date: Fri, 06 Nov 2026 10:15:32 GMT
Server: nginx
Content-Type: text/html
Content-Length: 217
Connection: close
<html>
<head><title>400 Request Header Or Cookie Too Large</title></head>
<body>
<center><h1>400 Bad Request</h1></center>
<center>Request Header Or Cookie Too Large</center>
<hr><center>nginx</center>
</body>
</html>SEO and redirect checking
Search engines treat 400 like other 4xx errors: the URL is not indexed, and an indexed URL that starts returning 400 is dropped. Crawlers send small, standard requests without cookies, so a 400 that only crawlers get usually comes from unusual characters in a URL or a firewall rule. In a redirect check, a 400 in the middle of a chain often means that a redirect produced a malformed URL, for example with double-encoded characters or a broken query string.
Common causes and use cases
- Too many or too large cookies. Clear the site's cookies, or raise
large_client_header_buffersin nginx. - A malformed URL, such as unencoded spaces, broken percent-encoding or an invalid
Hostheader. - An API request with invalid JSON or missing required parameters.
- A plain HTTP request sent to an HTTPS port, which nginx reports as "The plain HTTP request was sent to HTTPS port".