What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
A 400 response in an Nginx–Varnish stack is usually caused by the first proxy that rejects the request, not necessarily by your origin server. Identify that emitting hop before changing a buffer. Check the request’s HTTP syntax, Host header, PROXY-protocol framing, cookies and forwarded headers; then raise only the specific Nginx or Varnish limit that the evidence shows is too small.
Need a server to try this on? Antihost offers Linux VPS plans with NVMe storage, full root access and a 14-day free trial.
The distinction matters because Nginx and Varnish enforce different limits. In Nginx, one request-header field must fit in a single large_client_header_buffers buffer. Varnish separately limits header count, individual-header length, total request size and, for HTTP/2, the header-list size. A backend response-header overflow is a different path that normally produces a 503, not this client-side 400.
As an Amazon Associate I earn from qualifying purchases.
Recommended Free Tools
What the 400 means in an Nginx and Varnish chain
HTTP 400 means the component processing the request considers it malformed or unacceptable. With a typical flow, a client connects to Varnish, Varnish forwards to Nginx or another upstream, and Nginx forwards to the application. Depending on the listening ports and TLS arrangement, Nginx may instead be the public edge and Varnish may sit behind it. The response can therefore be generated before the request reaches the next hop.
Do not start by increasing every buffer. A larger limit can consume more memory per connection, permit unnecessarily large attack traffic and hide a client or proxy that is emitting broken headers. First determine whether the failure is syntax, protocol framing, a count limit, a per-field limit or a total-size limit.
#1 Best Overall
- [Ultra-Lightweight Ear Buds Designed for Small Ears] Each earbud weighs only 3.7g and features a compact, ergonomic in-ear design made especially for small ears. Secure, low-profile, and comfortable for workouts, all-day wear or overnight sleeping.The ultra-slim profile sits flush in your ear with no hard edges poking or rubbing, so you can even sleep on your side without discomfort.
- [Immersive Stereo Sound with TOZO OrigX Technology] TOZO OrigX tuning delivers clear vocals, balanced mids, and natural stereo sound for music, podcasts, and videos.
- [Long Battery Life for Daily Use] Get up to 7 hours of playtime on a single charge, with up to 32 hours total using the charging case—ideal for workdays, commuting, and extended listening sessions.
- [Bluetooth 5.3 & Stable Connection] Bluetooth 5.3 provides fast pairing, stable wireless performance, and reduced dropouts as you move around home or office.
- [Deep Bass with Clear Vocals] High-performance drivers produce punchy bass while keeping vocals clean and detailed for everyday listening.
Identify which hop generated the 400
Use the same failing request and compare the public endpoint with each listener that you can reach directly. Capture the status code, response headers, body, timestamp and any request identifier. Then correlate the timestamp with Nginx access and error logs and with Varnish Shared Log (VSL) output from varnishlog.
- Call the public URL. Record the complete response. A distinctive Varnish parser rejection often appears with a Varnish-generated body or headers, while an Nginx rejection may match the Nginx error-page format. Do not rely on the body alone; proxies can replace one another’s error pages.
- Query the Varnish listener directly. Use the same method, path and headers while bypassing the public edge where your network permits. A 400 here points to Varnish or to the framing of the connection sent to Varnish.
- Query the Nginx listener directly. Repeat the request against the Nginx address and port, preserving the relevant headers. If Nginx returns 400 while Varnish accepts the request, investigate Nginx parsing and its header buffers.
- Check the origin separately. If both proxies accept the request but the origin rejects it, the public 400 may be an application response rather than a proxy parser error.
- Read VSL for the transaction. Varnish records such as
BogoHeader,LostHeaderandRespStatus 400strongly indicate that Varnish abandoned the client transaction. Match the record’s timestamp and request details with Nginx logs.
Keep the exact software versions and Varnish edition in your notes. Defaults and parameter names can vary by installed release or build, even though the diagnostic categories remain the same.
Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallCheck request syntax and connection framing
HTTP/1.1 must contain one valid Host header
An HTTP/1.1 request must include exactly one valid Host header. Varnish documents a 400 response when it receives an HTTP/1.1 request without Host. Check custom health checks, old clients and intermediate proxies that construct the request themselves. Also look for duplicate or conflicting host fields introduced when a proxy appends rather than replaces a header.
Rank #2
- 【IP68 Waterproof Multifunctinal Smart Watch】Torjalph fitness activity tracker smart watch is IP68 waterproof technology ,you can wear it when swimming,handwashing,it's rain-proof which means that you perform multiple exercise modes outside without worrying about sweat or rain corroding your fitness smart watch,and this watch equipped with a 230 mAh large capacity battery magnetic charging ,and this sports activity tracker watch can be used 5-7 days If fully charged.
- 【Larger 1.83'' Full Screen Watch & Multi-dial Selection】1.83 inch full HD color touch screen smart watch for men / women provides excellent 240*284 resolution image quality ,This Bluetooth smart watch offers a better touch experience and remarkable immersion and ,more than 200 watch faces for you to choose from App"Da Fit ", you can change the dial style according to your mood to wear keeping the world on your wrist
- 【Accurate Activity Tracker Smart Watch 】sports watch activity tracker uses sweat and dust resistant breathable silicone strap, our Fitness Tracker Smart Watch for Android iOS Phones supports 12 sports modes,walking,running,bicycle,swimming,badminton,basketball,football,rope skipping. This bluetooth calls smart watch for men women is lightweight and stylish, bringing more convenient and relaxing sports experience while also providing more protection.
- 【Your 24 Hour Personal Daily Health Monitor】Fitness watch for women men full touch screen IP67 waterproof bluetooth smartwatch for Android iOS Phones with heart rate blood pressure monitor multifunction Andriod smart watch with steps counter sleep monitor sports fitness watch, monitoring blood oxygen saturation allows you to understand your physical condition in real time to track fitness progress ,to know your health status in time.
- 【More Functions Bluetooth Call Smart Watch】This fitness activity smart watch full screen for iPhone and Android phones includes a bunch of new features including:The bluetooth smart watch can hang up the phone, receive and display WhatsAPP /Text /Facebook /Twitter /Messenger reminder.Support sedentary reminder, alarm clock, stopwatch, timer,weather information,music control, remote camera control compatible with Android 5.0 and above or iOS 9.0 and above smartphones.
Verify PROXY-protocol agreement
The PROXY protocol is connection framing, not an ordinary HTTP header. If a listener is configured to expect PROXY protocol, its peer must send the agreed version and framing before the HTTP request. If one side expects it and the other side sends plain HTTP, the first bytes are interpreted incorrectly and can result in an HTTP/1.1 400. Confirm the setting on both ends of every proxy-to-proxy connection; do not enable it on only one side.
Make sure TLS reaches the intended listener
Decide where TLS terminates. Sending plain HTTP to a TLS-only socket, or TLS handshake bytes to a plain HTTP socket, can produce parser failures that look like ordinary bad requests. Check the listener address, port and load-balancer health-check protocol. A request should be decrypted exactly once before the component that parses HTTP receives it, unless your design explicitly passes TLS through.
Remove malformed header syntax
Inspect clients and upstream proxies for illegal whitespace, control characters, missing header names and malformed continuation lines. Header names and separators must follow the HTTP grammar accepted by the installed proxy. Varnish’s BogoHeader diagnostics are useful when the parser rejects a malformed field. Fix the sender rather than making the parser more permissive.
Rank #3
- [Low Noise High Fidelity] New bee guitar cord with 22AWG oxygen-free-copper center conductors provides enhanced signal transfer, the PVC insulation material and the high-density stranded copper double shield provide noise rejection for quiet operation
- [Ideal for Choice] New bee 1/4 straight and right angle metal connectors, ensures a secure connection in any instrument, pedal, or amp jack. L shape great fro on stage guitar stands
- [Wide Compatible] Suitable for mixer, power amplifier, microphone, effector, decoder, equalizer, electoronic organ, electric guitar, electric bass and other electronic equipments. Widely used in the installation of smart home, karaoke speaker, professional stage audio, etc
- [Easy Disassemble] Making incidental repairs quick and easy! Very nice, flexible cable
- [Dont Hesite to Order] 24 hours customer services and professional technology team are standing by
Understand the size and count limits
| Component | Setting or rule | Documented default or behavior | Failure implication |
|---|---|---|---|
| Nginx | large_client_header_buffers |
4 buffers of 8 KB in the cited Nginx reference | An individual request-header field that exceeds one buffer produces 400. |
| Nginx | Request line | Uses the client-header buffers | A request line that exceeds one buffer normally produces 414 (Request-URI Too Large), not 400. |
| Varnish | http_max_hdr |
64 header lines | Too many fields can make Varnish abandon the client transaction with 400. |
| Varnish | http_req_hdr_len |
8 KB | Limits an individual request-header field; an overlong field can be rejected. |
| Varnish | http_req_size |
32 KB | Limits the complete request, including its headers and framing. |
| Varnish HTTP/2 | h2_max_header_list_size |
Release-dependent; verify the installed configuration | A header-list overflow points to the HTTP/2 limit rather than an HTTP/1.1 buffer. |
The Nginx rule is per field: four 8 KB buffers do not allow one 32 KB cookie. The field still has to fit inside one buffer. Increasing the number of buffers helps only when Nginx needs more buffers to hold multiple fields; increasing an individual buffer’s size is what accommodates a longer single field.
Find oversized or duplicated request data
Compare a failing request with a minimal request that succeeds. Preserve the method and path, then remove optional headers one group at a time. The usual contributors are:
- Cookie: stale application cookies, repeated set-cookie values copied into a request, experiment flags and large session data can create one very long field.
- Authorization: oversized bearer tokens or accidentally duplicated credentials can exceed a per-field limit.
- Forwarded headers: repeated
X-Forwarded-For,X-Forwarded-Hostor related chains grow at every proxy. - Tracing headers: debugging baggage and vendor-specific trace fields can multiply as a request crosses services.
- Header count: many small fields can exceed Varnish’s
http_max_hdreven when no single field is large.
Use packet capture or an application-side request dump only in a controlled environment, because cookies and authorization values are sensitive. Redact values while retaining each field’s name and byte length. Determine whether the problem is one field, the sum of all fields or the number of fields before selecting a setting.
Rank #4
- Digital Family Calendar: BSIMB digital calendar wall touch screen puts an end to your chaotic life. Designed for busy families, the digital calendar keeps you organised and in step with your family. Assign different colours and tasks to each family member to make family scheduling easier and more intuitive.
- Easy Setup and Auto-Sync: Plug in, connect to WLAN and auto-syn your electric calendar in minutes. Digital wall calendar compatible with Google calendar, iCloud calendar, Outlook calendar, Cozi calendar and Yahoo calendar. Add events directly on the device or through the ecalendar app. Electronic calendar stays current whether you're at work or traveling—no manual updates needed.
- All-In-One Home Assistant: Smart calendar builds habits and encourage independence with personalised chores. Display daily meal plan to reduce the daily ‘What's for dinner?’ stress. To-do lists keep track of everything you want. Turning chores into valuable achievements with stars and rewards, making life easier and more enjoyable.
- Manage Anytime Anywhere: BSIMB electronic calendar for family stay connected with the powerful ecalendar app. Access and manage your digital wall calendar anytime, anywhere with free features like stars & rewards, photo screensaver, chore charts, meals plans, to-do lists etc. Electronic planner paid features like Magic Import tailor advanced tools for users with special needs.
- Stay in Touch with Loved Ones: Share photos or videos from your phone to electronic wall calendar with app, instantly update your life moment, and keep in touch with your family, especially those who are far away; you can also surprise your smart calendar digital wall by sending him a wish card; it's also great for keeping tech-illiterate elders in touch with the youngsters.
Fix the request at its source first
Clean cookies
Expire obsolete cookies at the application, delete duplicate cookie names and avoid storing large state in client cookies. A server-side session identifier is usually smaller than serialised preferences or tokens. Test a private browser session or a request with the cookie header removed to confirm whether cookies are causal; do not treat that test as a production fix.
Shorten forwarding chains
Configure each trusted proxy to replace or correctly append the forwarding information expected by the next hop. Remove duplicate hop-by-hop additions and set a bounded trust chain. Ensure that a retry or redirect does not add another copy of the same tracing or forwarding field.
Repair clients and custom health checks
Correct code that emits blank names, illegal characters, duplicate mandatory fields or HTTP/1.1 requests without Host. Health checks should use the same protocol, TLS mode and framing as real traffic. A check that sends plain HTTP to a PROXY-protocol or TLS listener can generate misleading alerts.
Apply a narrow Nginx change when Nginx is the emitter
Change Nginx only after its logs or direct-listener test show that Nginx rejects a legitimate request. The following example raises the per-field capacity while keeping the number of buffers explicit:
http {
client_header_buffer_size 4k;
large_client_header_buffers 4 16k;
server {
listen 80;
# proxy_pass and normal Varnish routing here
}
}- Measure the largest legitimate header field and add headroom rather than choosing an arbitrary maximum.
- Set
client_header_buffer_sizeandlarge_client_header_buffersat the narrowest suitablehttporserverscope. Avoid changing unrelated virtual hosts. - Remember that a single field must fit in one large buffer. If the cookie is 12 KB, four 4 KB buffers do not solve it; a 16 KB buffer does.
- Run
nginx -tand stop if validation reports a syntax or context error. - Reload through your normal change-control process, then replay the exact request and check both access and error logs.
Increasing Nginx limits allows more data to be read and stored per connection. Keep limits proportional to real traffic and review rate limiting and connection caps if the change materially increases exposure.
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Repair Windows errors before they cause bigger problemsFix Now →Apply a narrow Varnish change when Varnish is the emitter
Varnish limits are commonly set as startup parameters or in the service configuration used to launch the installed release. The following values illustrate the parameter names and a possible targeted increase, not universal recommendations:
-p http_max_hdr=96
-p http_req_hdr_len=16k
-p http_req_size=64k- Use VSL to establish whether the failure is header count, one header’s length or total request size. Do not raise all three for an error that identifies only one.
- Change the startup or service configuration appropriate to your Varnish version and deployment method.
- Restart or reload as that service requires, verify that the new parameters are active, and replay the original request.
- Watch memory use, worker behavior and rejection logs after the change. Larger workspaces consume more memory and do not make malformed headers valid.
For HTTP/2, inspect the configured header-list limit when VSL reports a header-list overflow. HTTP/2 compresses headers on the wire, but the decoded list still has a configured size budget. Confirm that the client, Varnish build and downstream hop agree on the protocol before changing an HTTP/1.1 setting.
Choose the remedy by failure class
| Observed evidence | Likely emitter | Preferred action | What not to do |
|---|---|---|---|
BogoHeader or malformed-field details in VSL |
Varnish | Fix illegal syntax, control characters or broken continuation lines at the sender. | Do not increase limits to accept invalid grammar. |
HTTP/1.1 request lacks Host |
Varnish or another HTTP parser | Fix the client or health check to send one valid Host. |
Do not add an arbitrary host in a proxy without confirming the intended virtual host. |
| One cookie or authorization field is larger than one Nginx buffer | Nginx | Reduce the field; if legitimate, increase the buffer size at the required scope. | Do not merely increase the buffer count. |
| Many fields and Varnish reports header-count overflow | Varnish | Remove duplicates; only then consider http_max_hdr. |
Do not raise every request limit globally. |
| Total request exceeds Varnish’s request budget | Varnish | Trim cookies and forwarding data; increase http_req_size only for justified traffic. |
Do not assume a per-field change fixes total size. |
| PROXY or TLS framing mismatch | Connection parser at the receiving hop | Make listener and peer settings identical. | Do not troubleshoot cookies until framing is correct. |
Backend response shows BogoHeader, FetchError or response-header overflow with 503 |
Varnish while fetching from origin | Inspect and reduce origin response headers or the backend parser configuration. | Do not treat it as the client-request 400 path. |
Retest without creating a second failure
- Save a representative failing request with secrets removed but lengths preserved.
- Test a minimal request, then add the suspected cookie, authorization and forwarding fields back one group at a time.
- Send the request through the public endpoint and, where possible, directly to Varnish and Nginx. Record status, response headers and timestamps for each hop.
- Confirm that Nginx access and error logs contain the request when Nginx should receive it, and that VSL shows no parser rejection.
- Test both HTTP/1.1 and HTTP/2 if clients use both protocols. A successful HTTP/1.1 test does not prove that the HTTP/2 header-list budget is sufficient.
- Exercise normal traffic after the change, including authentication, redirects and cache misses. Verify that the request reaches the intended backend rather than merely receiving a different proxy error page.
- Monitor memory and error rates. Roll back a broad limit increase if it permits abusive request sizes or destabilizes workers.
When the status changes from 400 to 503
A 503 after your change is not proof that the original setting was correct. If Varnish logs a backend BogoHeader, FetchError or response-header overflow, the client request passed farther into the stack and Varnish rejected what the origin returned. Inspect response cookies, cache-control fields, forwarding metadata and other origin headers separately. Keep client-request limits and backend-response limits in different incident records so that a fix for one direction does not obscure the other.
Quick Recap
Operational safeguards
- Record the installed Nginx and Varnish versions before changing defaults; vendor defaults can vary by release, build and edition.
- Apply changes in configuration management so the effective startup parameters and scope are reviewable.
- Use the smallest limit that accommodates measured legitimate traffic, with a documented reason for its headroom.
- Protect logs and packet captures because cookies, authorization tokens and tracing data can contain personal or security-sensitive information.
- Keep a rollback ready and compare memory consumption before and after any increase.
- Do not publish an incident-rate estimate for this error without local measurements; no authoritative prevalence figure is established for the Nginx-behind-Varnish combination.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Fix the driver behind crashes, sound loss and screen glitches3Clear out junk files and repair common Windows errors
