Here are the reasons that one or more bridge MOSFETs can fail (in no particular order):
1. Excessively long switching times - in this voltage/switching frequency range the voltage across each MOSFET should take 50-100ns to transition from off to on and vice versa. Note that this should be measured while under a meaningful load (at least 10%, ideally >50%). Also note that too fast a transition time causes lots of EMI, ringing/voltage overshoots and exacerbates problems with body diode conduction (see below).
2. Cross conduction - check DC current into bridge with no load (including shunt [e.g. - capacitive] filter components); should be close to 0mA. Adjust deadtime between bridge legs until it just gets to 0mA (you don't want too much deadtime, either).
3. Body diode conduction - the intrinsic inverse parallel diode in all MOSFETs (even ones that claim to be fast) is pathetically slow compared to a purpose-built fast diode. With a purely resistive load, ideal (near-zero) deadtime and cross-conduction, the body diodes will never conduct in a full bridge. But with a reactive load (more specifically, leading power factor [ie - capacitive], which can come from the output filter in a pure sine wave inverter!) and/or excessive dead time (typically >200ns) the body diodes will start conducting current, and they then take a long time to turn off (reverse recovery), and the entire time the body diode tries to turn off it presents a direct short to the MOSFET in the other leg which has just turned on.
4. Excessively narrow pulse width - this problem tends to occur at very low load in a bridge using regular PWM (as opposed to phase shift modulation). How narrow is too narrow depends on a lot of other variables, but limiting the minimum pulse width to 5% of the switching period is a good start (and yet another case of too little load being a problem).
5. Overvoltage/ringing during turn off - caused by undamped stray inductance in between switches in a bridge leg or between the DC link capacitor and the bridge. These inductances form resonant tanks with the sum of the effective output capacitance of the switches in a bridge leg. This, then, is primarily a physical layout problem. Even with good layout, though, RC dampers across each switch and/or the transformer primary are frequently needed (note that quasi-resonant transition and phase-shifted bridges put these strays to good use, and the latter topology is also very good at dealing with reactive loads).
6. Finally, the obvious stuff like insufficient gate drive voltage, excessive drain current, too low a voltage rating relative to supply, etc.