Fix HTTP 405 Method Not Allowed Error

Updated 6 November 2026 · Standard formula, shown below

This guide explains how to diagnose and fix the HTTP 405 Method Not Allowed error. You’ll learn what causes it, how to check your server and code, and what to do when the standard fixes don’t work. It applies to anyone running a website or API, whether you’re using Apache, Nginx, IIS, or a framework like Express or Django.

What You’ll Need

Access to your web server configuration files (e.g., .htaccess, nginx.conf, web.config)
Access to your application’s route definitions or controller code
Browser developer tools (F12) or a tool like curl to test HTTP methods
Basic understanding of HTTP methods (GET, POST, PUT, DELETE, etc.)

Step-by-Step

Identify the exact URL and method that triggers the error. Open your browser’s developer tools (F12) and go to the Network tab. Refresh the page or reproduce the action that caused the 405. Look for the request that returns status 405 and note its URL and method (GET, POST, etc.). If you’re testing an API, use curl or Postman to send the same request and confirm the error.
Check the server logs. Look at the error log for your web server (e.g., Apache’s error.log, Nginx’s error.log, or the application log). The log entry usually shows the requested URL and method. This can reveal if the request is being blocked by a firewall or a rewrite rule before it reaches your application.
Verify that the route actually supports the method. In your application code, find the route or endpoint that matches the URL. Ensure it accepts the HTTP method you’re sending. For example, in Express: app.get('/user', ...) only accepts GET. If you POST to that URL, you’ll get a 405. Add the missing method handler, or change the client to use the correct method.
Check for server-level restrictions. Some servers restrict certain methods by default. For Apache, look at the <Limit> directive in .htaccess or the virtual host. For Nginx, check the limit_except block. For IIS, review the Request Filtering settings. If you see something like <Limit GET POST>, it only allows those methods. Remove or modify the restriction to allow the needed method.
Inspect URL rewriting rules. If you use mod_rewrite (Apache) or try_files (Nginx), a rewrite rule might be sending your request to a different endpoint that doesn’t support the method. For example, a rule that redirects all requests to index.php might lose the original method. Test by temporarily disabling the rewrite rules and see if the 405 disappears. If it does, adjust the rule to preserve the method (e.g., using the [PT] flag in Apache).
Check for middleware or plugins. If you’re using a CMS (like WordPress) or a framework with middleware, a plugin or middleware might be rejecting the method. Disable custom middleware one by one and test. In WordPress, a security plugin might block certain methods for non-logged-in users. Temporarily deactivate plugins to isolate the cause.
Examine the response headers. The 405 response should include an Allow header listing the permitted methods. For example, Allow: GET, POST. Compare that to the method you’re sending. If the method isn’t listed, the server is intentionally rejecting it. If the header is missing, the server might be misconfigured.
Test with a direct request. Use curl to send the exact request to the server, bypassing any client-side code. For example: curl -X POST https://example.com/api/user. This tells you if the issue is server-side or client-side. If curl works but the browser doesn’t, the problem might be in your JavaScript code (e.g., using the wrong method).
Restart the web server after making changes. After editing configuration files, restart Apache (sudo systemctl restart apache2) or Nginx (sudo systemctl restart nginx) to apply the changes. For IIS, run iisreset or recycle the application pool.
Clear browser and server caches. Sometimes a cached response (from the browser or a CDN) can show a 405 even after you’ve fixed the server. Clear your browser cache and, if you use a CDN like Cloudflare, purge the cache for that URL.

Common Mistakes

Confusing 405 with 404. A 405 means the URL exists but the method isn’t allowed. A 404 means the URL doesn’t exist at all. If you’re getting a 404, the route or file is missing.
Forgetting to save the file. After editing .htaccess or nginx.conf, make sure you save the file and restart the server. A typo in the file can cause a server error or a different response.
Using the wrong method in client code. For example, a form that uses method="get" when the server expects POST. Double-check the HTML form or fetch call.
Ignoring the Allow header. The Allow header is the definitive answer from the server. If it says GET, POST, and you’re sending PUT, you know the server is configured to reject PUT.
Modifying the wrong configuration file. If you have multiple virtual hosts or sites, you might edit the wrong .htaccess or nginx server block. Verify you’re editing the file that corresponds to the domain or subdomain.

Tips

Use the Allow header to see exactly what methods are permitted. That’s the fastest way to know if the server is the problem.
When testing, use a tool like curl with the -v flag to see the full request and response headers.
In development, enable detailed error messages in your framework (e.g., APP_DEBUG=true in Laravel) to get more context.
If you’re using a REST API, follow the HTTP spec: use GET for retrieving, POST for creating, PUT/PATCH for updating, DELETE for deleting. Many servers are configured to reject methods that don’t match the route’s purpose.
Keep a list of all your routes and the methods they accept. This helps you spot missing routes quickly.

Troubleshooting

If the error persists after following the steps above, try these additional checks:

Check for a reverse proxy or load balancer. If your site is behind a proxy (like HAProxy or AWS ALB), the proxy might be stripping the method or forwarding it incorrectly. Check the proxy logs and configuration.
Look for a firewall or security module. ModSecurity (Apache) or a WAF (Web Application Firewall) might be blocking certain methods. Temporarily disable ModSecurity to see if the 405 goes away. If it does, add a rule to allow the method.
Verify the URL is correct. A trailing slash can change the route. For example, /api/user and /api/user/ might be different routes in some frameworks. Test both.
Check for a misconfigured .htaccess in a subdirectory. If you have multiple .htaccess files, a parent directory’s rule might affect a subdirectory. Move or rename the .htaccess files to isolate the issue.
If you’re using a framework, clear the route cache. Some frameworks (Laravel, Symfony) cache routes. Run php artisan route:clear or the equivalent to clear the cache.

Frequently Asked Questions

What does the 405 error mean exactly?

It means the server understood the request URL, but the HTTP method (GET, POST, etc.) you used is not allowed for that specific resource. For example, you tried to DELETE a page that only supports GET.

Why do I get a 405 on a form submission?

Most likely the form’s method attribute (e.g., method="post") doesn’t match the server route’s expected method. Check the form tag and the server route definition.

Can a browser extension cause a 405?

Rarely, but some extensions modify requests. Try incognito mode or disable extensions to rule this out.

Is a 405 error permanent?

No, it’s a temporary server response. Once you fix the server configuration or code, the error will disappear. It’s not like a 404 that might indicate a permanently missing resource.

How do I fix a 405 in WordPress?

Usually it’s caused by a security plugin or a permalink issue. Try disabling plugins one by one, and then flush permalinks by going to Settings > Permalinks and clicking Save Changes.

What’s the difference between 405 and 501?

405 means the method is not allowed for that URL. 501 Not Implemented means the server doesn’t support the method at all (e.g., sending a PATCH request to a server that only implements GET and POST).

Method: the standard formula for this calculation, rounded as each result states. See how the calculators work or report an error.