405 Error Explained: Causes, Fixes, and Prevention Tips

AJAX/Fetch: Verify that the request method is set correctly in JavaScript:

 fetch('/api/data', {
  method: 'POST'
})

• Frameworks: Some frameworks (like Angular, React, or Django) may default to certain methods if you don’t explicitly set them. Double-check your client-side and server-side code for mismatches.

Note: This step is often where beginners get tripped up, sending data to the right endpoint but with the wrong verb.

5. Examine Server Configuration

If both headers and code look fine, the issue may be server-level restrictions. Admins often block methods for security reasons, but if legitimate requests are being stopped, adjusting these settings is necessary.

Apache: Look for Limit or LimitExcept directives in your .htaccess or main config. Example:

 
   Require all granted

• If PUT is missing here, any PUT request will return a 405.

Nginx: Check limit_except directives:

 location /api/ {
   limit_except GET POST {
      deny all;
   }
}

• This would reject methods other than GET and POST.
• IIS: Open the IIS Manager, go to Request Filtering, and review the HTTP Verbs tab. Blocked verbs like PUT or DELETE will show up here.

Fixing a 405 Error by Platform/Environment

Fixing a 405 error depends on the platform or environment your website or application is running on. Since each server type and content management system handles HTTP requests differently, the solution can vary. Let’s go over some common platforms and walk through the steps we can take to review configurations and adjust settings so the correct HTTP methods are allowed.

Quick pre-check (applies to all)

1.Reproduce the error and read headers

curl -i -X PUT https://example.com/path

2. If you see Allow, adjust your request/client to match. If you don’t, continue below.

Apache

1.Locate config

• Site config: /etc/apache2/sites-available/*.conf or /etc/httpd/conf.d/*.conf
• Per-dir rules: project .htaccess

2. Back up the file you’ll edit

sudo cp /etc/apache2/sites-available/site.conf /etc/apache2/sites-available/site.conf.bak

3. Search for method restrictions

• Look for , , or RewriteRule patterns that block verbs.

# Example: only GET/POST allowed here

  Require all denied

4. Add the needed method(s) or remove the restrictive block

  Require all denied

5. Validate and reload

sudo apachectl -t
sudo systemctl reload apache2   # or: sudo systemctl reload httpd

6. Retest with curl

curl -i -X PUT https://example.com/path

7. If still blocked, check security layers (e.g., mod_security audit logs) and virtualhost precedence.

Nginx

1.Open the server block for your site

• Common paths: /etc/nginx/sites-available/, /etc/nginx/conf.d/*.conf

2. Back up the file

sudo cp /etc/nginx/sites-available/site.conf /etc/nginx/sites-available/site.conf.bak

3. Look for limit_except blocks

location /api/ {
  limit_except GET POST {
    deny all;
  }
}

4. Add the needed method(s) or remove the block if unnecessary

location /api/ {
  limit_except GET POST PUT {
    allow all;
  }
}

5. Test and reload

sudo nginx -t
sudo systemctl reload nginx

6. Retest with curl

curl -i -X PUT https://example.com/api/resource

7. If you proxy to an app server, confirm upstream also allows the method.

IIS (Windows Server)

1. Open IIS Manager → select the site.
2. Go to Request Filtering → HTTP Verbs.
3. Remove any Deny entries for verbs you need (e.g., PUT, DELETE) or add Allow entries if your policy requires explicit allows.
4. Check Handler Mappings: if WebDAV is installed and intercepting verbs you need, remove or disable the WebDAV handler for that site (or uninstall WebDAV if not needed).
5. If present, review web.config for:

   ... 
  
    
      
        
        
      
    
  

6. Recycle the app pool or restart the site.

7. Retest with curl/Postman.

WordPress & other CMS platforms

1. Re-save permalinks
   • Settings → Permalinks → Save Changes (this refreshes rewrite rules).
2. Test for plugin conflicts
   • Temporarily disable all plugins.
   • Re-enable one by one to find the offender (security, REST/API, caching, and firewall plugins are common causes).
3. Check platform-generated rules
   • Apache: .htaccess sections added by plugins.
   • Nginx: server blocks added for caching/security that might contain limit_except or method filters.
4. If you use the CMS REST API, verify accepted methods on the endpoint and adjust the client or route config accordingly.
5. Retest key actions (forms, logins, admin actions) after each change.

APIs (general)

1.Confirm the contract

• Check the API docs for each endpoint’s allowed methods and expected paths.

2, Probe the endpoint

# Discover allowed methods (if supported)
curl -i -X OPTIONS https://api.example.com/v1/items/123
# Then try the method you intend
curl -i -X PATCH https://api.example.com/v1/items/123

3. Fix client or server (examples)

• Client fix: send the method the endpoint actually supports (e.g., POST instead of PUT).
• Express (Node.js)

 app.post('/items', createItem);
app.put('/items/:id', updateItem);
// If PUT not defined, add it—or switch your client to POST if that's the design.

 @app.route('/items/', methods=['GET','POST','PUT','DELETE'])
def item(id): ...

4. Set a helpful 405 with Allow header (server-side)

• If your framework doesn’t auto-set it, add the header listing permitted methods.

5. If fronted by an API gateway/WAF, review method filtering rules there as well.

6. Retest with Postman/curl and confirm the expected 2xx/3xx/4xx flow.

After the fix: quick verification list

• The action now returns a success or the correct error (not 405).
• Allow header accurately lists permitted methods.
• Logs show normal handling, not a blocked verb.
• Automated tests (if you have them) cover the corrected path and method.

Preventing 405 Errors in the Future

Fixing a 405 error when it appears is only half the challenge—preventing it from happening again is what saves you time and frustration in the long run. By putting the right practices in place during development and configuration, you can reduce the chances of users or applications running into unsupported methods. Here are several approaches that help keep 405 errors from becoming recurring problems.

Validate Methods in Code

When writing forms, scripts, or API calls, double-check that you’re only using HTTP methods that the server allows. For instance, if your server accepts POST for submitting data, make sure you don’t accidentally use GET or PUT. Validating methods early in development also helps catch mistakes before they reach production. Many frameworks let you define allowed methods directly in routes or controllers, making it easier to enforce correct usage.

Document Server Rules

Servers often have method restrictions defined in their configuration files (like .htaccess, nginx.conf, or API gateway settings). Keeping a record of what methods are supported makes it easier for both developers and administrators to understand the limits. This documentation is especially useful in larger teams or long-term projects, where server rules can otherwise get lost or forgotten over time.

Error Handling

Even with careful planning, unsupported method requests may slip through. That’s why it’s useful to provide clear error messages when a 405 occurs. Instead of a vague “Method Not Allowed,” customize the response so the user or developer understands what went wrong and how to correct it—for example, by including the list of allowed methods in the response header or suggesting the right method in your documentation.

Follow Standards

If you’re building APIs, sticking to REST best practices and HTTP standards makes it easier for clients to know what to expect. For example, if you design an endpoint for updating a resource, use PUT or PATCH consistently. This predictability reduces the risk of unsupported methods being sent and helps external developers interact with your API correctly.

Wrapping Up

The 405 Method Not Allowed error tells you that the server knows the resource exists, but it doesn’t allow the method you tried.

The key takeaway: check the Allow header, review logs, and make sure your code and server rules match the methods you intend to support.