diff --git wp-admin/load-scripts.php wp-admin/load-scripts.php
index 8a0ee3c17f..a2e9ed04d4 100644
--- wp-admin/load-scripts.php
+++ wp-admin/load-scripts.php
@@ -14,18 +14,6 @@ if ( ! defined( 'ABSPATH' ) ) {
 
 define( 'WPINC', 'wp-includes' );
 
-$load = $_GET['load'];
-if ( is_array( $load ) ) {
-	$load = implode( '', $load );
-}
-
-$load = preg_replace( '/[^a-z0-9,_-]+/i', '', $load );
-$load = array_unique( explode( ',', $load ) );
-
-if ( empty( $load ) ) {
-	exit;
-}
-
 require( ABSPATH . 'wp-admin/includes/noop.php' );
 require( ABSPATH . WPINC . '/script-loader.php' );
 require( ABSPATH . WPINC . '/version.php' );
@@ -47,6 +35,24 @@ if ( isset( $_SERVER['HTTP_IF_NONE_MATCH'] ) && stripslashes( $_SERVER['HTTP_IF_
 	exit();
 }
 
+$load =  isset( $_GET['load'] ) ? $_GET['load'] : null;
+if ( $load === null || ! is_array( $load ) || ( is_array( $load ) && count( $load ) === 0 ) ) {
+	header( "HTTP/1.1 400 Bad Request" );
+	exit();
+}
+
+if ( is_array( $load ) ) {
+	$load = implode( '', $load );
+}
+$load = preg_replace( '/[^a-z0-9,_-]+/i', '', $load );
+$load = array_unique( explode( ',', $load ) );
+$load = array_filter( $load );
+
+if ( count( $load ) === 0 ) {
+	header( "HTTP/1.1 400 Bad Request" );
+	exit();
+}
+
 foreach ( $load as $handle ) {
 	if ( ! array_key_exists( $handle, $wp_scripts->registered ) ) {
 		continue;
diff --git wp-admin/load-styles.php wp-admin/load-styles.php
index 82dacef60a..73dc7d7fc9 100644
--- wp-admin/load-styles.php
+++ wp-admin/load-styles.php
@@ -18,17 +18,6 @@ require( ABSPATH . 'wp-admin/includes/noop.php' );
 require( ABSPATH . WPINC . '/script-loader.php' );
 require( ABSPATH . WPINC . '/version.php' );
 
-$load = $_GET['load'];
-if ( is_array( $load ) ) {
-	$load = implode( '', $load );
-}
-$load = preg_replace( '/[^a-z0-9,_-]+/i', '', $load );
-$load = array_unique( explode( ',', $load ) );
-
-if ( empty( $load ) ) {
-	exit;
-}
-
 $compress       = ( isset( $_GET['c'] ) && $_GET['c'] );
 $force_gzip     = ( $compress && 'gzip' == $_GET['c'] );
 $rtl            = ( isset( $_GET['dir'] ) && 'rtl' == $_GET['dir'] );
@@ -47,6 +36,24 @@ if ( isset( $_SERVER['HTTP_IF_NONE_MATCH'] ) && stripslashes( $_SERVER['HTTP_IF_
 	exit();
 }
 
+$load =  isset( $_GET['load'] ) ? $_GET['load'] : null;
+if ( $load === null || ! is_array( $load ) || ( is_array( $load ) && count( $load ) === 0 ) ) {
+	header( "HTTP/1.1 400 Bad Request" );
+	exit();
+}
+
+if ( is_array( $load ) ) {
+	$load = implode( '', $load );
+}
+$load = preg_replace( '/[^a-z0-9,_-]+/i', '', $load );
+$load = array_unique( explode( ',', $load ) );
+$load = array_filter( $load );
+
+if ( count( $load ) === 0 ) {
+	header( "HTTP/1.1 400 Bad Request" );
+	exit();
+}
+
 foreach ( $load as $handle ) {
 	if ( ! array_key_exists( $handle, $wp_styles->registered ) ) {
 		continue;