As part of filtering out potential harmful traffic, I currently reject traffic where $_SERVER["HTTP_ACCEPT"] is empty.
I notice from my logs that a fair number of requests have been rejected due to the accept header being empty and some of them come from valid IP traffic when requesting favicon.ico.
I currently block these favicon.ico requests with a "403 Forbidden" (I know I should probably use 406 Not Acceptable).
I do have a favicon.ico on my site. I am aware that favicon.ico "not found" errors are not seen by the user. Is it the same for me blocking these pages or will they see the 403 Forbidden page?
I would like to test this myself, but I do not know how to generate a page request with empty headers. Perhaps if someone has a way to do this as well, it will help.
Thanks for your input.