HTTP 400 — Bad Request
4xx Client Error
What it means
The server could not understand the request: malformed JSON, an invalid query parameter, a header that does not parse.
What to do about it
Check the request body actually parses, that required fields are present, and that Content-Type matches what you are sending. Return a body explaining which field was wrong — a bare 400 wastes everyone's time.
Where it sits
400 belongs to the 4xx family: The request contains something the server will not or cannot process. The fix is normally on the client side.
HTTP/1.1 400 Bad RequestChecking it yourself
# see the status code and headers only
curl -sI https://example.com/path
# follow redirects and print each hop
curl -sIL -o /dev/null -w "%{http_code} %{url_effective}\n" https://example.com/path
# JavaScript
const r = await fetch(url);
console.log(r.status, r.statusText);How this code behaves
| Cacheable by default | No — caches must not store this response unless explicit cache headers permit it. |
| Safe to retry | No. Retrying an identical request will produce the same result — the request itself must change. |
| Effect on search indexing | No direct effect. |
Returning 400 correctly
# nginx
return 400;
# Express
res.status(400).json({ error: 'Bad Request' });
# Go
w.WriteHeader(400)
# Python (Flask)
return jsonify(error='Bad Request'), 400;Frequently asked questions
What does HTTP 400 mean?
The server could not understand the request: malformed JSON, an invalid query parameter, a header that does not parse.
How do I fix a 400 error?
Check the request body actually parses, that required fields are present, and that Content-Type matches what you are sending. Return a body explaining which field was wrong — a bare 400 wastes everyone's time.
Is 400 a client or server problem?
A client problem by definition — the request needs to change. That said, a 4xx can still be the server’s fault if it is misconfigured and rejecting valid requests.