admin-ajax.php 400 Error: Why Actions Silently Fail (2026)

You open DevTools because something silently fails - a form won't submit, autosave stalls, a button spins forever. The Network tab shows admin-ajax.php returning 400, or responding with a bare "0". This is WordPress's universal AJAX endpoint failing, and the fix depends on which failure mode you're seeing.

First: Decode the Failure Mode

• Response "0": the request reached WordPress but no action hook caught it - missing action param, dead nonce, or the handler isn't registered for your login state
• HTTP 400: the request was malformed or rejected before the handler ran - often a security layer
• HTTP 403: a firewall blocked it - check the 403 guide and WAF logs
• HTTP 500: the handler fatals - see the 500 guide and enable WP_DEBUG_LOG

Fix 1: The Stale Nonce (Most Common)

If the error appeared after enabling page caching, this is it. The page was cached with a nonce from an old session; the AJAX call validates the nonce and dies. Exclude logged-in users from cache and exclude admin-ajax.php itself. Clear the cache and retest - solved in most cases.

Fix 2: Identify the Failing Action

In DevTools, click the failing request → Payload/Form data → find action. Its value names the plugin's hook (e.g., wpcf7_submit = Contact Form 7). That tells you exactly which plugin owns the broken AJAX. Deactivate/reinstall it, or check its settings for a REST/AJAX toggle.

Fix 3: Firewall and Security Rules

Wordfence, Sucuri, iThemes, Cloudflare WAF and mod_security all inspect AJAX bodies. A form submission containing HTML, URLs, or serialized data can trip a rule. Check your firewall's block log for entries hitting admin-ajax.php and whitelist the specific action or the logged-in path. Also check your CDN isn't POST-blocking - Cloudflare "Bot Fight Mode" is a frequent offender.

Fix 4: Works Logged-In, Fails Logged-Out

Classic missing wp_ajax_nopriv_ hook - the developer only registered the handler for authenticated users. If it's your code, add the nopriv hook. If it's a plugin, that's a bug: report it or find an alternative. Confirm quickly by testing the action in an incognito window.

Fix 5: Plugin Conflict Sweep

If nothing above fits, do the binary search: rename wp-content/plugins to plugins_off, retest the failing action, then reactivate in halves until it breaks. It's the same isolation method used for the wp-admin blank screen - crude but definitive.

Keep Reading

• Invalid JSON response - the Gutenberg/REST sibling of this error
• WordPress 403 forbidden - firewall blocks in depth
• 429 too many requests - if admin-ajax is being rate-limited
• Critical error fix - when the handler fatals
• Bluehost review 2026
• WordPress 'Cannot Modify Header Information - Headers Already Sent' Fix (2026)
• WordPress Theme Broken After Update: Layout Destroyed (2026)
• Locked Out: Too Many Failed Login Attempts (2026)
• Increase the WordPress Maximum Upload File Size (2026)