diff --git a/resources/prosody-plugins/mod_muc_poltergeist.lua b/resources/prosody-plugins/mod_muc_poltergeist.lua
index 638e556f0..519e87d28 100644
--- a/resources/prosody-plugins/mod_muc_poltergeist.lua
+++ b/resources/prosody-plugins/mod_muc_poltergeist.lua
@@ -169,6 +169,10 @@ end, -100);
 -- @param event the http event, holds the request query
 -- @return GET response, containing a json with response details
 function handle_create_poltergeist (event)
+    if (not event.request.url.query) then
+        return 400;
+    end
+
     local params = parse(event.request.url.query);
     local user_id = params["user"];
     local room_name = params["room"];
@@ -194,6 +198,10 @@ end
 -- @param event the http event, holds the request query
 -- @return GET response, containing a json with response details
 function handle_update_poltergeist (event)
+    if (not event.request.url.query) then
+        return 400;
+    end
+
     local params = parse(event.request.url.query);
     local user_id = params["user"];
     local room_name = params["room"];
diff --git a/resources/prosody-plugins/mod_muc_size.lua b/resources/prosody-plugins/mod_muc_size.lua
index d8d2716c5..b481f78ac 100644
--- a/resources/prosody-plugins/mod_muc_size.lua
+++ b/resources/prosody-plugins/mod_muc_size.lua
@@ -72,6 +72,10 @@ end
 -- @return GET response, containing a json with participants count,
 --         tha value is without counting the focus.
 function handle_get_room_size(event)
+    if (not event.request.url.query) then
+        return 400;
+    end
+
 	local params = parse(event.request.url.query);
 	local room_name = params["room"];
 	local domain_name = params["domain"];
@@ -121,6 +125,10 @@ end
 -- @param event the http event, holds the request query
 -- @return GET response, containing a json with participants details
 function handle_get_room (event)
+    if (not event.request.url.query) then
+        return 400;
+    end
+
 	local params = parse(event.request.url.query);
 	local room_name = params["room"];
 	local domain_name = params["domain"];