405 Method Not Allowed: How to Fix It Fast on Apache, NGINX, APIs, WordPress, and Forms

by

405 Method Not Allowed means the server understands the HTTP method, but the specific resource you requested does not allow that method. In simple terms, the URL exists, the server knows what GET, POST, PUT, or DELETE means, but that endpoint is not configured to accept the method you used.

This is a configuration or application logic problem, not a generic outage. In many cases, the page or API route is live, but the request method, routing rules, rewrite layer, security settings, or app controller do not match what the client is sending.

Quick Fix

  • Check which HTTP method the request is using: GET, POST, PUT, PATCH, DELETE, or OPTIONS.
  • Check the response headers for an Allow header.
  • Confirm the route actually supports that method.
  • If this is a form, make sure the form method matches the route logic.
  • If this is an API, check whether you are using the correct verb for the endpoint.
  • Review server rewrite rules, redirects, and proxy behavior.
  • Temporarily disable security plugins, WAF rules, or request filters if they may block the method.
  • If WordPress is involved, check plugins, permalinks, REST API rules, and caching.
  • Test the endpoint with OPTIONS or a manual request tool to see allowed methods.
  • Review recent server, framework, routing, or deployment changes first.

What Is 405 Method Not Allowed?

405 Method Not Allowed is an HTTP client error response. It means the request method is recognized by the server, but not supported by the target resource.

This is different from several similar errors:

  • 404 Not Found means the resource itself cannot be found.
  • 403 Forbidden means access is understood but denied.
  • 501 Not Implemented means the server does not support the method at all.
  • 405 Method Not Allowed means the server knows the method, but that specific URL does not allow it.

Typical examples:

  • sending POST to a route that only accepts GET,
  • sending DELETE to a resource where deletion is disabled,
  • submitting a form to a page that is not configured to handle form posts,
  • sending a CORS preflight OPTIONS request to a server that does not handle it correctly.

A normal 405 response should also return an Allow header showing which methods the resource actually accepts.

HTTP/1.1 405 Method Not Allowed
Allow: GET, POST, HEAD

If that header is missing, the response is not being generated cleanly or the stack is interfering with the normal behavior.

Why 405 Method Not Allowed Happens

Most real cases come from a short list of causes.

1. The Client Uses the Wrong HTTP Method

This is the most common cause.

Typical examples:

  • a browser sends GET where the backend expects POST,
  • an API client sends PUT to an endpoint that only allows PATCH,
  • a JavaScript app sends DELETE to a route that was never built for it,
  • a webhook calls the right URL with the wrong verb.

The route exists, but the method does not match.

2. The Server Route Exists, but Method Handling Is Incomplete

This is common in frameworks and custom apps.

Examples:

  • the route was created only for GET,
  • the controller method for POST was never added,
  • the route registration changed in a deployment,
  • the API spec and the backend code no longer match.

This is especially common after rushed updates.

3. A Form Uses the Wrong Method

HTML forms often create 405 errors when:

  • the form action points to the wrong URL,
  • the form uses GET instead of POST,
  • the backend expects AJAX but receives a normal form post,
  • the endpoint accepts display requests but not form submission.

This is very common on login pages, contact forms, and admin actions.

4. REST API Routing Is Misconfigured

Modern APIs often separate methods very strictly:

  • GET for reading,
  • POST for creating,
  • PUT or PATCH for updating,
  • DELETE for removing.

If the route table or middleware rejects one of those verbs, 405 is the natural result.

5. Web Server Rules or Reverse Proxy Layers Block the Method

Sometimes the application is correct, but Apache, NGINX, a reverse proxy, or a CDN/WAF blocks the method before it reaches the app.

This often happens because of:

  • security rules that disallow PUT, DELETE, or TRACE,
  • location blocks in NGINX,
  • Limit or method restrictions in Apache,
  • reverse proxies that only forward selected verbs,
  • WAF rules that treat some methods as suspicious.

6. CORS Preflight Requests Are Not Handled Properly

This is a very common API issue.

Browsers often send an OPTIONS request before the real request. If the server or proxy does not handle OPTIONS correctly, the browser may show a method-related error even though the real business logic never ran.

This is common when:

  • CORS was added later,
  • API gateways block OPTIONS,
  • backend routes ignore preflight behavior,
  • security tools reject non-GET/POST traffic.

7. WordPress, Plugins, or Security Rules Interfere

WordPress sites can trigger 405 errors through:

  • security plugins,
  • REST API restrictions,
  • broken permalinks,
  • caching layers,
  • mod_security rules,
  • contact form plugins sending requests to blocked endpoints.

In those cases, the method may be valid in theory, but something in the WordPress stack blocks it.

8. Redirects Turn One Method into Another Broken Flow

Some 405 errors happen after a redirect chain.

For example:

  • a form posts to URL A,
  • URL A redirects to URL B,
  • URL B does not support the resulting method flow,
  • the request ends in a 405.

This is especially common after HTTPS migrations, admin rewrites, or trailing-slash normalization changes.

How to Fix 405 Method Not Allowed Step by Step

Start by finding out which method is failing and where it is being blocked.

1. Check Which HTTP Method Is Being Sent

This is the first and most important step.

Find out whether the request is using:

  • GET
  • POST
  • PUT
  • PATCH
  • DELETE
  • OPTIONS
  • HEAD

You cannot fix a 405 until you know the exact verb that is failing.

2. Check the Allow Header

A correct 405 response should tell you which methods are allowed.

If the response says:

Allow: GET, POST

then you already know the resource does not currently accept the method you used.

If the Allow header is missing, suspect:

  • broken framework behavior,
  • proxy interference,
  • WAF filtering,
  • custom error handling that hides the real response.

3. Check Whether the URL Is Correct

A small route mistake can create a 405 even when the method itself is valid elsewhere.

Check for:

  • wrong endpoint path,
  • missing trailing slash where routing is strict,
  • admin vs public endpoint confusion,
  • versioned API mismatch like /v1/ vs /v2/.

The method may be right, but the resource may be wrong.

4. Check Forms and JavaScript Requests

If this is a browser form or frontend app:

  • confirm the form method is correct,
  • confirm the action URL is correct,
  • confirm JavaScript fetch or AJAX calls use the intended method,
  • confirm redirects are not changing the flow unexpectedly.

This solves many 405 errors on login pages, forms, and dashboards.

5. Check Server Routing or Framework Route Definitions

If you control the app, inspect the route table.

Look for:

  • routes registered only for GET,
  • controller methods missing for POST or PUT,
  • middleware blocking some verbs,
  • deployment mismatch between docs and actual code.

This is one of the most common API-side causes.

6. Check Apache, NGINX, and Reverse Proxy Rules

If the app looks correct, inspect the web server layer.

On Apache, look for:

  • <Limit> or <LimitExcept> rules,
  • security modules,
  • rewrite rules,
  • virtual host mismatch.

On NGINX, look for:

  • location blocks,
  • method restrictions,
  • proxy pass issues,
  • misrouted upstreams.

If you use a reverse proxy, make sure it forwards the method you expect.

7. Check CORS and OPTIONS Handling

If this is an API used by browsers, test whether the failure is really the preflight request.

Check whether:

  • OPTIONS is accepted,
  • CORS headers are correct,
  • the route allows cross-origin methods,
  • a gateway or WAF blocks preflight requests.

This is one of the most common reasons modern frontend apps hit 405 unexpectedly.

8. Disable Security Rules or Plugins Temporarily

If the problem started after a security change, test whether:

  • WAF rules,
  • mod_security,
  • WordPress security plugins,
  • bot filters,
  • API gateway protections

are blocking the method.

This is especially common with PUT, DELETE, PATCH, and OPTIONS.

9. Review Recent Changes First

This is often the shortest route to the cause.

Ask what changed before 405 started appearing:

  • new route or controller,
  • server config change,
  • reverse proxy deployment,
  • WordPress plugin update,
  • WAF or security hardening,
  • CORS change,
  • API version change.

Most 405 issues begin right after one of those changes.

Advanced Troubleshooting

Understand the Difference Between 405 and 501

This matters more than many teams realize.

  • 405 means the server knows the method but this resource does not allow it.
  • 501 means the server does not support that method at all.

If you are seeing 405, the method is known somewhere in the stack. The problem is resource-level handling, routing, or filtering.

Use OPTIONS to Check Allowed Methods

OPTIONS is one of the best diagnostics for 405 problems.

It can help you see:

  • which methods the resource supports,
  • whether CORS preflight works,
  • whether the server and proxy agree on allowed verbs.

If OPTIONS itself fails unexpectedly, the proxy, WAF, or routing layer becomes a stronger suspect.

Watch for Hidden Redirects

Method problems often hide behind redirects.

Check whether the request is being redirected:

  • from HTTP to HTTPS,
  • from non-www to www,
  • from one API version to another,
  • from a login endpoint to a generic page.

The final URL may be the one rejecting the method, not the original URL you thought you were testing.

Check Application Logs and Access Logs Together

The access log may show the request reaching the server, while the application log may show why it was rejected.

That combination often reveals:

  • missing route registration,
  • middleware rejection,
  • method mismatch,
  • security filtering,
  • upstream mismatch.

Prevention Tips

  • Document allowed methods for each route clearly.
  • Keep frontend forms and API docs aligned with backend routing.
  • Test OPTIONS, POST, PUT, and DELETE after deployments.
  • Review WAF and security rules before blocking non-GET methods broadly.
  • Be careful with redirects around forms, APIs, and admin pages.
  • Use consistent API versioning and route conventions.
  • Check server and proxy rules whenever methods suddenly stop working.

The best prevention is simple: make sure the route, the method, the proxy layer, and the security layer all agree on what is allowed.

When to Contact Support

Contact your developer or backend team if:

  • the route exists but the method is not handled correctly,
  • API docs and backend behavior do not match,
  • the issue started after code deployment.

Contact your hosting provider or server admin if:

  • Apache or NGINX may be blocking the method,
  • reverse proxy rules are involved,
  • firewall or WAF behavior may be interfering.

Focus on WordPress/plugin troubleshooting if:

  • the issue started after a plugin update,
  • forms or REST API endpoints are affected,
  • security plugins or caching layers are installed.

FAQ

What does 405 Method Not Allowed mean?

It means the server understands the HTTP method, but the specific resource you requested does not allow that method.

What is the difference between 405 and 404?

404 means the resource is not found. 405 means the resource exists, but the method used for the request is not allowed there.

How do I fix 405 Method Not Allowed fast?

Check which HTTP method is being used, inspect the Allow header, verify the route supports that method, then review server rules, proxies, security layers, and recent changes.

Can CORS cause a 405 error?

Yes. If the browser sends a preflight OPTIONS request and the server or proxy does not handle it correctly, you can get a 405 before the real request is even sent.

Can WordPress cause a 405 error?

Yes. Security plugins, REST API restrictions, broken permalinks, caching, contact form plugins, and server security rules can all trigger 405 errors on WordPress sites.

Final Thoughts

405 Method Not Allowed usually means the server, route, or security layer knows the method but refuses to allow it on that resource. In practice, the most common causes are wrong request method, incomplete route handling, form mismatches, CORS preflight failures, proxy restrictions, and security rules.

Start with the basics: exact method, exact URL, and the Allow header. Then move through the routing, server, proxy, and security layers in that order. That approach solves most 405 errors much faster than treating them like a generic server failure.

“`

Leave a Comment