406 Not Acceptable means the target resource has no representation that matches the client's negotiation headers, such as Accept, Accept-Language or Accept-Encoding, and the server is not willing to send a default representation. The body should list the available representations so the user or client can choose.
In practice, most servers ignore preferences they cannot satisfy and send a default representation, which RFC 9110 explicitly allows. 406 therefore mostly appears in APIs that serve only certain media types, for example a JSON API that receives Accept: application/xml.
Some hosting providers configure security modules such as ModSecurity to answer blocked requests with 406, so a 406 can also be a firewall decision rather than a negotiation problem.
Example response
HTTP/1.1 406 Not Acceptable
Date: Fri, 06 Nov 2026 10:15:32 GMT
Vary: Accept
Content-Type: application/json
Content-Length: 57
{"error":"Available formats: application/json, text/csv"}SEO and redirect checking
Crawlers send broad Accept headers, so they should not receive 406; if they do, the URL is treated as a 4xx error and not indexed. When a redirect check returns 406 but the page loads in a browser, look at any custom Accept headers you added, or at a security rule that matches the user agent or URL.
Common causes and use cases
- An API supports only JSON, but the client asked for XML or another format.
- A strict
Accept-Languagesetup has no matching translation and no fallback. - A ModSecurity or WAF rule on shared hosting blocks the request with 406.