HTTP 405 Method Not Allowed: Fix GET, POST and OPTIONS Errors

A 405 means the URL exists, but the HTTP method you used (GET, POST, PUT, DELETE, PATCH or OPTIONS) is not permitted for it. The specification requires the server to send an Allow header listing the methods that do work. That header is the fastest diagnostic you have. See the HTTP 405 reference.

Do not confuse it with 404, where the resource is missing, or 501, where the server does not recognize the method at all.

Read the Allow header first

curl -i -X POST https://example.com/api/items

Look for a line like this in the response:

HTTP/2 405
allow: GET, HEAD, OPTIONS

It tells you the endpoint accepts reads but not POST. Compare with what your code sends. The HTTP Header Checker shows response headers from outside your network. If there is no Allow header, a proxy, framework or firewall in front may be generating the response.

If you are a visitor

1. Reload the page instead of resubmitting a form, then try the action again from the start.
2. Go back to the form page and submit from there. Opening a form's target URL directly sends GET, which many handlers refuse.
3. Disable extensions that alter requests, and try a private window.
4. Report it to the site with what you clicked. A 405 on a normal button is a bug the owner can fix.

If you own the site or API

1. The client uses the wrong method or URL

Check the route table of your framework against the call. Typos such as POST /api/item versus /api/items, or calling a read-only endpoint with PUT, are common. Many frameworks return 405 when the path exists for some other method.

2. nginx serving a static file for a POST

nginx answers POST to a static file with 405 (the error_page route returns "405 Not Allowed"). This happens when the request never reaches your application, usually because the location is wrong or the proxy rules are missing.

location /api/ {
    proxy_pass http://127.0.0.1:3000;
}

Verify with sudo nginx -T which location wins for the URL. A form posting to /contact.html on a static site needs a real handler or a third-party form service.

3. Apache or application limits

Apache can restrict methods with Limit, LimitExcept or Require method. A rule meant to block risky verbs may also block REST APIs.

<Location "/api">
    <LimitExcept GET POST PUT DELETE OPTIONS>
        Require all denied
    </LimitExcept>
</Location>

Also check hosting-level WAF rules and mod_security. WebDAV, PUT and DELETE are disabled on many shared hosts. If your cause is a method the server truly cannot handle, see 501 Not Implemented.

4. CORS preflight fails with OPTIONS

Browsers send an OPTIONS preflight before cross-origin requests with custom headers or non-simple methods. If your server answers that preflight with 405, the real request never runs. Handle OPTIONS and return the right Access-Control-Allow-* headers. Test with the CORS Checker. The related browser message is covered in No Access-Control-Allow-Origin.

5. A redirect turned your POST into GET

When a server answers a POST with 301 or 302, many clients repeat the request as GET to the new address, and the endpoint (which only accepts POST) replies 405. Typical triggers are an HTTP to HTTPS redirect or a trailing-slash redirect on the API URL. Call the final HTTPS URL directly, or use 307/308 redirects, which preserve the method. Trace hops with the रीडायरेक्ट चेकर and read HTTP redirects: 301 vs 302.

6. CDN or caching rules

Some CDN rules or page-cache plugins only allow GET and HEAD on certain paths. If the origin responds correctly but the public hostname gives 405, bypass the cache for that path.

Test each method safely

Use a staging URL where possible:

for m in GET HEAD POST PUT DELETE OPTIONS; do
  printf "%s " $m; curl -s -o /dev/null -w "%{http_code}\n" -X $m https://example.com/api/items
done

Compare results with the documented contract. Confirm the final status with the HTTP स्टेटस चेकर, and keep an अपटाइम मॉनिटर on the health endpoint. The डेवलपर टूल्स page lists other helpers for debugging requests.

अगले कदम

• Read the HTTP 405 reference.
• Check cross-origin behavior with the CORS Checker.
• Review redirects and method changes.
• Break a URL apart with the URL पार्सर.

सामान्य प्रश्न

What is the difference between 405 and 404?

404 says nothing is at that URL. 405 says something is there, but not for the method you used.

Why does my form get 405 after submit?

The target URL may be a static page, a redirect may have changed POST to GET, or the handler only allows another method. Check the form action and the Allow header.

Does HEAD need to be allowed?

Servers should support HEAD wherever GET is allowed. Uptime tools and crawlers often use it.

Can I fix 405 by allowing every method?

Avoid that. Allow only the methods each endpoint needs, so scanners cannot reach unintended behavior.

यह पेज सामान्य जानकारी है, जिसे हमारी संपादकीय टीम ने लिखा है और दस्तावेज़ीकरण बदलने पर अपडेट किया जाता है। सर्वर और प्रदाता अलग-अलग होते हैं, इसलिए बदलाव पहले सुरक्षित तरीके से जाँचें। देखें: संपादकीय नीति और अस्वीकरण.