406 Not Acceptable: what it means and what to do
A 406 is about content negotiation, the part of HTTP where the client says what formats it can accept and the server picks one. The official definition in RFC 9110 is that the target resource has no representation that would be acceptable according to the Accept headers sent with the request. In practice it appears most often with APIs, where a client asks for a format, a version, or a language the server does not offer.
If you are just visiting a site
- Refresh the page. A 406 in a normal browser is unusual, because browsers send broad Accept headers. A one-off can be a misbehaving extension or a mangled request.
- Disable browser extensions and retry. Privacy and developer extensions sometimes rewrite Accept headers, and a site with strict negotiation can reject the result.
- Try another browser or device. If the page loads there, the cause sits in your usual browser's headers or cache.
- If it persists, it is the site's configuration. Some security tools, notably mod_security on Apache servers, are notorious for returning 406 for requests they merely dislike. Only the site owner can change that.
If it is your site or your API
- Log the Accept header on failing requests. You cannot fix a negotiation failure without knowing what was asked for. Clients sending Accept: application/json to an XML-only endpoint is the textbook case.
- Consider a sensible default. Many APIs avoid 406 entirely by serving their primary format when the Accept header is vague or absent, which RFC 9110 permits.
- Check your security layer. If ordinary browser requests are getting 406, look at mod_security or WAF rules before touching application code. That pattern is a known false-positive factory.
- Document your formats. For versioned APIs, state clearly which media types and versions exist, so clients stop guessing.
Visitors: a persistent 406 on a normal web page almost always traces back to the site's security configuration. Owners: check the WAF before the framework.
Common questions
Why would a normal website show me a 406? The commonest cause is a server security module, usually mod_security, using 406 as its rejection code for requests it flags. From the visitor's side it looks random, because the page itself is fine and the rejection happens before the page is ever reached.
Is 406 the same as 415? No, they are mirror images. A 406 is about the format of the response the client wants back. A 415 is about the format of the request body the client sent, which the server does not support.
Related errors