Content negotiation

Compression, which almost every server negotiates and which is the most universally used form of it.

Image format, where a pipeline returns a modern format to clients that accept one and an older format to those that do not.

Language, on sites that serve translations from one URL rather than from separate ones.

Media type, on APIs that can return more than one representation of the same resource.

A scan advertising support for modern formats and receiving an older one is seeing either a pipeline that does not negotiate or one with nothing better stored.

Those two produce the same observation and need different fixes, which is why the finding is phrased as what was delivered rather than as what visitors receive.

The same applies to compression: an uncompressed response may mean compression is off, or that an intermediary stripped the negotiation header on the way through.

Which is also why the alternative — declaring the variants in the markup — fails more visibly, and is easier to audit for exactly that reason.

Instead of negotiating in the response, a page can declare the candidates and let the browser choose — a picture element listing formats, a srcset listing widths.

That moves the decision from the server to the client, and it makes the available options visible to anyone reading the HTML.

It costs markup and it removes a class of silent failure, since a missing candidate is visible where a non-negotiating server is not.

Both approaches are legitimate. Most image pipelines use the first; most hand-built pages use the second.

A negotiated response must declare what it varied on, or a shared cache will serve one client's variant to another.

That is not a subtlety: it is how a client that accepts no modern format receives one and fails to display it.

Compression negotiation without the corresponding declaration is the most common instance, which is why most servers add it automatically.

So negotiation and cache variation are two halves of one mechanism, and implementing the first without the second creates the failure it was meant to avoid.

The client sends preference lists with relative weights, so it expresses an order rather than a single demand.

The server intersects those preferences with what it can produce and picks the best available match.

Where nothing matches, the correct answer is a 406 — which almost no server sends, preferring to return a default instead.

A server that ignores the preferences entirely and always returns one representation is not negotiating, and is indistinguishable from one that has nothing else to offer.