HTTP 400 Bad Request

Client error code, RFC 9110, section 15.5.1

What it means

The server could not understand the request, because something in it is malformed or invalid, such as broken syntax or an oversized header.

A real response

This is the request and the answer our test server gave when we asked it to return 400.

GET /c/400 HTTP/1.1
Host: example.com

HTTP/1.1 400 Bad Request
Date: Sat, 14 Nov 2026 10:00:00 GMT
Content-Type: text/html; charset=utf-8
Content-Length: 11

<p>demo</p>

If you run the site

Look at what the client sent: invalid JSON, a missing required parameter, or bad characters in the address. Return a clear message in the body that says what is wrong. Do not use 400 for "not logged in" (401) or "not allowed" (403).

If you are a visitor

Reload the page. If it is a site that stores cookies, clear its cookies: an oversized or damaged cookie is a common cause of 400 on a working site.

A common mistake

Returning 400 with no explanation, so developers cannot tell which field was wrong.

Registered in the IANA HTTP Status Code Registry as Bad Request, defined in RFC 9110, section 15.5.1.

This is an independent guide. It is not connected with the IETF, IANA, any browser maker or any company named here. Meanings were checked against the RFC texts on 14 November 2026. Responses shown were recorded on 14 November 2026 from a small test server on the author's own computer.