http error 406

The Role of Content Negotiation and Accept Headers

To understand a 406 error, you must understand how a client and server agree on the format of data. When a client sends an HTTP request, it usually includes several Accept headers. These headers act as a wish list, telling the server what formats, languages, and encodings the client is capable of processing.

• Accept: Specifies the media types (MIME types) the client wants (e.g., application/json, text/html, image/webp).
• Accept-Charset: Specifies the character sets (e.g., utf-8, iso-8859-1).
• Accept-Encoding: Specifies the compression algorithms (e.g., gzip, br).
• Accept-Language: Specifies preferred languages (e.g., en-US, fr-FR).

If an API client sends a request with the header Accept: application/xml, it strictly demands XML data. If the backend server is programmed only to output JSON data (application/json), it cannot fulfill the strict requirement. A properly configured server will recognize this impasse and return an HTTP 406 Not Acceptable error.

Common Causes of an HTTP 406 Error

While standard web browsing rarely results in a 406 error because modern browsers send highly permissive Accept headers (often ending with */* meaning "I'll take anything"), it is a frequent hurdle in API development and specific server configurations.

1. Strict API Development

In RESTful API development, a client might explicitly request a data format (like PDF or XML) that the endpoint does not support. If the routing framework is strictly typed, it will block the response and return a 406 rather than sending data the client's parser will fail to read.

2. Mod_Security rules in Apache

For WordPress and standard CMS users, a 406 error is frequently caused by a Web Application Firewall (WAF) rule, specifically the mod_security module in Apache web servers. If a user submits a form or a URL containing data that looks suspicious (like SQL commands or strange characters), mod_security intercepts the request. Because returning a standard 403 Forbidden might tip off a hacker, the firewall sometimes returns a 406 Not Acceptable to silently block the malicious payload.

3. Missing File Extensions

Some legacy servers rely on the URL's file extension to determine the content type instead of looking at the data itself. If a client requests /api/data.json but the server maps that extension to a MIME type it doesn't know how to handle, it may throw a 406.

How to Fix an HTTP 406 Not Acceptable Error

The resolution depends heavily on whether you are building the client, building the server, or managing a CMS like WordPress.

For API Developers (Client Side)

If you are consuming an API and receive a 406, you must inspect the headers you are sending. Look at your fetch or Axios configuration. Ensure that your Accept header matches what the API documentation says the server can provide. If the server only returns JSON, make sure you send Accept: application/json or use the wildcard Accept: */*.

For Server Developers (Backend Side)

If you are building an API, it is generally considered best practice to be liberal in what you accept. If a client sends an `Accept` header you cannot fulfill, you can either return the 406 error, or (more commonly) ignore the strict requirement and return your default format (like JSON), allowing the client to decide whether to attempt to parse it.

For Website Owners (CMS / WordPress)

If your users are seeing a 406 error when submitting a contact form or accessing a specific URL, it is almost certainly a mod_security rule triggering a false positive. To fix this:

1. Check your server error logs (e.g., Apache error log). It will show exactly which mod_security rule ID was triggered.
2. Once you identify the rule ID, you can ask your hosting provider to whitelist that specific rule for your domain.
3. As a last resort (and not recommended for security reasons), you can disable mod_security for a specific directory via an .htaccess directive: <IfModule mod_security.c> SecFilterEngine Off </IfModule>.

Frequently Asked Questions