WhatsApp us
Fix admin-ajax.php 400 Error in WordPress (Complete Guide)
- Tech Area
- Last updated on: January 19, 2026
The admin-ajax.php 400 error is a common WordPress issue that breaks AJAX features such as contact forms, load-more buttons, filters, and login requests. When this error occurs, AJAX requests fail and no data is returned.
In this guide, you’ll learn why admin-ajax.php returns a 400 Bad Request error and how to fix it step by step, using proven PHP and WordPress solutions.
What Is admin-ajax.php in WordPress?
admin-ajax.php is the core WordPress file used to handle AJAX requests for both logged-in and non-logged-in users.
It is widely used for:
1. Contact forms
2. AJAX pagination
3. Load more posts
4. Live search
5. Filters
When it fails, dynamic functionality stops working.
Why admin-ajax.php Shows 400 Error
The most common causes include:
1. Missing or invalid nonce
2. Incorrect AJAX URL
3. Security plugins blocking requests
4. Server ModSecurity rules
5. Incorrect request parameters
6. Theme or plugin conflicts
Fix 1: Use Correct AJAX URL (MOST IMPORTANT)
Always use admin_url() instead of hardcoding the URL.
Correct Way
wp_localize_script('custom-js', 'ajax_obj', array(
'ajax_url' => admin_url('admin-ajax.php'),
'nonce' => wp_create_nonce('ajax_nonce')
));
Do NOT use:
/wp-admin/admin-ajax.php
Fix 2: Check AJAX Action Hooks
A missing hook causes a 400 error.
Correct Hooks
add_action('wp_ajax_my_action', 'my_ajax_handler');
add_action('wp_ajax_nopriv_my_action', 'my_ajax_handler');
✔ Required for guest users
✔ Required for logged-in users
Fix 3: Verify Nonce Properly
Invalid nonce = 400 error.
check_ajax_referer('ajax_nonce', 'nonce');
JavaScript
nonce: ajax_obj.nonce
If nonce mismatches → request fails.
Fix 4: Check PHP Function Output
Always end AJAX handlers with:
wp_die();
Without wp_die(), WordPress may throw a 400 error.
Fix 5: Disable Security Plugin Temporarily
Security plugins like:
1. Wordfence
2. iThemes Security
3. WP Cerber
may block AJAX.
Fix 6: Server ModSecurity Issue
Hosting firewalls often block POST requests.
Ask hosting support to disable ModSecurity for:
/wp-admin/admin-ajax.php
Fix 7: Debug Using Browser Console
Enable debugging:
define('WP_DEBUG', true);
define('WP_DEBUG_LOG', true);
Check:
1. Network tab → AJAX request
2. Response headers
3. debug.log file
Complete Working AJAX Example
JavaScript
jQuery.post(ajax_obj.ajax_url, {
action: 'test_ajax',
nonce: ajax_obj.nonce
}, function (response) {
console.log(response);
});
PHP
add_action('wp_ajax_test_ajax', 'test_ajax');
add_action('wp_ajax_nopriv_test_ajax', 'test_ajax');
function test_ajax() {
check_ajax_referer('ajax_nonce', 'nonce');
echo 'AJAX working!';
wp_die();
}
Conclusion
The admin-ajax.php 400 error in WordPress is usually caused by incorrect AJAX setup, nonce issues, or security restrictions. By following this guide, you can quickly restore AJAX functionality and prevent future errors.
Join 20,000+ subscriber