405 Method Not Allowed: Using the Wrong HTTP Verb
Allow header listing the methods that are allowed. This is a client‑side error — the client needs to use a different method or change the endpoint.
Common Causes of 405 Errors
| Cause | Example | How to Fix |
|---|---|---|
| Using the wrong HTTP method | POSTing to a read‑only endpoint that only supports GET. | Check the API documentation and use the correct method. |
| Server routing misconfiguration | Server doesn't have a route for PUT on that URL. | Add the missing route or correct the server configuration. |
| Static file serving | Attempting to POST to a static file (e.g., .html, .jpg). | Static files only support GET; use a different endpoint. |
| Browser form method limitation | HTML forms only support GET and POST; using PUT/DELETE requires special handling. | Use JavaScript fetch/XMLHttpRequest to send other methods. |
| Firewall or proxy blocking | Some proxies reject certain methods for security reasons. | Check proxy logs and adjust rules if necessary. |
Example: 405 Response with Allow Header
When a client sends a POST request to a read‑only endpoint, the server responds:
The Allow Header
The Allow header is required in a 405 response. It lists the HTTP methods that are valid for the requested resource. Example:
This tells the client that only GET, HEAD, and OPTIONS are allowed. The client can use this information to make a new request with a valid method.
Common HTTP Methods and Their Uses
- GET – retrieve a resource.
- POST – create a new resource.
- PUT – update (or replace) a resource.
- PATCH – partially update a resource.
- DELETE – remove a resource.
- HEAD – same as GET but without the response body (useful for checking headers).
- OPTIONS – retrieve the allowed methods for a resource (often used in CORS preflight).
How to Fix 405 Errors
- If you're a client developer: Check the API documentation for the correct method. Use tools like Postman or cURL to test different methods. For HTML forms, use JavaScript to send PUT/DELETE requests.
- If you're a server developer: Ensure your routing configuration includes the intended methods. In frameworks like Express, Flask, or Django, you can define methods per route. Also, check that middleware or proxies aren't blocking certain methods.
- If you're an end‑user: You'll likely see a "Method Not Allowed" error only if you're interacting with an API or a misconfigured website. Contact the site administrator.
Frequently Asked Questions
Is 405 a server error?
No, it's a client error (4xx). The client used an invalid method. However, the server should help by sending the Allow header.
Can I use POST to a URL that only supports GET?
No, you'll get a 405. You must use the method that the endpoint supports. If you need to send data, use a different endpoint that accepts POST.
What is the OPTIONS method used for?
OPTIONS is used to retrieve the allowed methods for a resource. It's commonly used in CORS preflight requests to check if the server allows cross‑origin requests from a specific origin.