Troubleshoot 400 errors
Published
Updated
❗
Bad Request.
A 400 Bad Request means the server rejected the request as broken. Either Apache found the request itself malformed, or the app refused the data it got. The fix sits with whoever sends the request.
Apache or the app
| Source | Typical cause | Where to look |
|---|---|---|
| Apache | A malformed URL, usually from a bot or scanner | Apache error log: AH00126 |
| The app | Failed CSRF check, invalid form data, broken JSON | PHP log, the response body |
| An API client | Missing header, such as an API key or a signature | The API's error message |
A 400 from Apache never reaches PHP, so the PHP log stays empty. A 400 from the app usually carries a message in the response body.
Check the request
Inspect the failing request in the network tab of the browser's developer tools, or repeat it with curl -v:
- Is the JSON body complete and valid, and does
Content-Typematch it? - Are the session cookie and the CSRF token sent? An expired session fails the CSRF check of most frameworks.
- Does the same request work in the local development environment?
The logs of the environment show both the Apache and the PHP side.