How to Fix 405 Method Not Allowed Error
What 405 Method Not Allowed means
Every time your browser or an app talks to a website, it uses an HTTP method: a verb that says what it wants to do. GET asks to read a page, POST submits data such as a form or a login, PUT replaces a resource, PATCH updates part of one, and DELETE removes one. HTTP status 405 means the server found the resource you asked for, but that resource is not set up to handle the verb you used. You will see messages like 405 Method Not Allowed, HTTP Error 405, or Method Not Allowed, often on form submissions, file uploads, and API calls rather than on ordinary page loads.
The key point is that a 405 is not a missing page. A 404 means the URL does not exist at all; a 405 means the URL is fine and the method is wrong. That distinction tells you where to look: not for a broken link, but for a mismatch between what the client sent and what the server allows. A classic example is a contact form that sends a GET request to an endpoint that only accepts POST, or an app that sends a DELETE request to a read-only API. The server answers with 405 and, helpfully, often includes an Allow header listing the methods it does accept for that resource.
Common causes
- Wrong HTTP method for the endpoint: a form, link, or API call uses GET where the server expects POST, or PUT or DELETE where only GET and POST are defined.
- Incorrect URL or trailing slash: a missing or extra trailing slash, a mistyped path, or a call to a collection URL instead of a single-item URL can land on a route that accepts different methods.
- Server configuration blocking a method: an Apache Limit block, an Nginx limit_except rule, or IIS verb handling can deny PUT, DELETE, or PATCH on a folder or location.
- Security plugin, firewall, or CDN rule: a WordPress security plugin, a web application firewall, or a CDN rule can block methods it treats as risky, breaking legitimate forms and API calls.
- Failed CORS preflight or missing CSRF token: a browser API call that fails its OPTIONS preflight check, or a form submitted without a valid CSRF token, can be rejected before the real request is ever handled.
How to fix the 405 Method Not Allowed error — step by step
Start with the visitor steps (1–2). If you own the site or the code, steps 3–6 are where most persistent 405 errors get fixed.
- Confirm the right URL and the right method. Open the page in your browser and check the address carefully, including any trailing slash: many sites treat /contact and /contact/ as different routes, and a form or API call aimed at the wrong one can return 405. If you are calling an API, check its documentation for the exact method the endpoint accepts: a read endpoint usually wants GET, a submit endpoint usually wants POST, and an update endpoint usually wants PUT or PATCH. In your browser, press F12, open the Network tab, and look at the failed request to see which method was actually sent.
- Reload properly, clear cache and cookies, and try incognito. A stale cached page or an old cached form can keep sending a request the server no longer accepts. Press Ctrl + F5 for a hard refresh, then press Ctrl + Shift + Delete, set the range to All time, check Cached images and files and Cookies and other site data, and click Clear data. Then open an incognito window (Ctrl + Shift + N) and try the same action again. If it works in incognito, a cached file, a cookie, or an extension in your normal window is the culprit.
- Fix the form, link, or API call sending the wrong method. If you control the page, open the form or the code that makes the request and check the method it declares. An HTML form without a method defaults to GET, which will fail on an endpoint that only accepts POST. An API client pointed at a collection URL when it should target a single item, or a JavaScript fetch call using PUT where the server only defines POST, produces the same error. Correct the method to match the route, save the change, and test the action again.
- Site owner: check server rules, plugins, and rewrite settings. If you own the site, a 405 often comes from a server rule rather than your code. In Apache, check .htaccess for Limit or LimitExcept blocks that restrict methods on that folder. In Nginx, check the location block for a limit_except rule that denies the method you need. In WordPress, a security plugin, a firewall rule, or a recent permalink change can block PUT, DELETE, or POST requests: temporarily disable the suspect plugin, save permalinks again under Settings and Permalinks, and test the affected page.
- Check CORS preflight and CSRF tokens for API and AJAX requests. Browser-based API calls first send an OPTIONS preflight request, and if the server does not answer it with the right CORS headers, the real request never happens and can surface as a 405. Make sure your server responds to OPTIONS requests and returns Access-Control-Allow-Methods listing the methods your app uses. If the request is a form submission, include the CSRF token the site expects: a missing or expired token can cause the server to reject the request outright. Refresh the page to get a fresh token, then submit again.
- Test with curl, check the logs, and contact the host or owner. From a terminal, run curl -i -X POST followed by the URL to see the status code and the Allow header, which lists the methods the server does accept for that resource. Site owners should check the server error log for the matching 405 entries: the log shows the exact URL and method that was rejected. If the method is blocked at a level you cannot change, such as a shared host or a CDN rule, contact your hosting provider and ask them to allow the method on that path. Visitors who cannot fix it themselves should report the exact URL, the action they were taking, and the method shown in the Network tab.
Did this fix it? Quick checklist
- The form or API call completes without a 405 message
- The method in the Network tab matches what the endpoint accepts
- It works in an incognito window and after clearing cache
- Site owners: no server, plugin, or firewall rule still blocks the method
If the error only appears on one network, such as office or school Wi-Fi, a proxy or firewall on that network may be stripping or blocking the method — try your phone's mobile data to confirm. On the owner side, if the 405 started right after moving hosts, changing CDN settings, or installing a security plugin, that change is the prime suspect: roll it back temporarily and test before digging into application code.
Frequently asked questions
What does a 405 Method Not Allowed error mean?
It means the page or endpoint exists, but it does not accept the HTTP method used to request it. For example, a page that only accepts GET requests will return 405 if you send it a POST request, and an API endpoint that only accepts POST will return 405 for a DELETE request. The resource is there; the way you asked for it is not allowed.
What is the difference between a 405 and a 404 error?
A 404 means the resource does not exist at that URL at all. A 405 means the resource does exist, but the HTTP method is wrong for it. Fixing a 404 means finding the right URL; fixing a 405 means sending the right method to the right URL.
Is a 405 error dangerous or a security problem?
No, a 405 by itself is not dangerous: it is a normal HTTP response that says a method is not allowed. It can, however, reveal a misconfiguration, such as a server blocking methods your app legitimately needs or allowing methods it should not. Keep authentication and CSRF protection in place regardless of which methods you allow.
How do website owners fix a persistent 405 error?
Check that the route is defined for the method being used, remove Limit or limit_except rules that block it, review security plugin and firewall rules, and make sure CORS preflight OPTIONS requests succeed. Check the server error log for the exact rejected URL and method, and if the block sits with your host or CDN, ask them to allow the method on that path.