HTTP 405 Method Not Allowed

HTTP 405 Method Not Allowed — The URL exists but doesn't support the HTTP method used; the Allow header lists the ones it does.

Class

4xx Client Error

Defined in

RFC 9110 §15.5.6

Official

Yes (IANA registry)

Cacheable by default

Yes (heuristically, per RFC 9110)

Safe to retry

Not without changing the request

What does HTTP 405 mean?

405 Method Not Allowed means the URL exists, but the HTTP method used (GET, POST, PUT, DELETE…) isn't supported for it. The server must include an Allow header listing the methods that are supported, e.g. Allow: GET, HEAD.

If the server doesn't recognise the method at all (for any URL), the right status is 501 Not Implemented instead.

When is 405 used?

• POSTing a form to a static file or a page that only handles GET.
• Calling DELETE /api/users when only DELETE /api/users/:id exists.
• A static host (S3, GitHub Pages, Netlify, nginx serving files) receiving POST or PUT.
• A route handler file that doesn't export the method being called (Next.js returns 405 automatically).

Common causes of a 405

• The client uses the wrong method for the endpoint.
• A redirect turned a POST into a GET (301/302) and the destination only accepts POST.
• A trailing-slash redirect on an API route dropped the method.
• WebDAV or security modules disabling PUT/DELETE on the server.

How to fix 405 Method Not Allowed

If you're visiting the site

1. Reload the page and try again from the site's normal navigation; you may have submitted an outdated form.
2. If it persists, it's a site bug — report it to the site owner.

If you run the site or API (developers)

1. Check the method the client sends against the route definition (and the API docs).
2. Always send an Allow header with 405 — and respond to OPTIONS with the same list.
3. Watch for redirects in front of POST endpoints; use 307/308 so the method is preserved.
4. On nginx serving static files, POST to a file returns 405 — proxy those requests to your app instead.

Returning or handling 405: server examples

location /api/webhook {
    limit_except POST { deny all; }  # non-POST gets 403
    proxy_pass http://app;
}

# Return a proper 405 with Allow:
location = /contact {
    if ($request_method !~ ^(GET|HEAD)$) {
        add_header Allow "GET, HEAD" always;
        return 405;
    }
}

app.route("/api/users")
  .get(listUsers)
  .post(createUser)
  .all((req, res) => res.set("Allow", "GET, POST").sendStatus(405));

// app/api/users/route.ts
// Only GET and POST are exported, so PUT/DELETE automatically get
// 405 Method Not Allowed with an Allow header.
export async function GET() { /* ... */ }
export async function POST(req: Request) { /* ... */ }

Example 405 response

HTTP/1.1 405 Method Not Allowed
Allow: GET, HEAD, OPTIONS
Content-Type: application/json

{"error":"method_not_allowed","allowed":["GET","HEAD","OPTIONS"]}

Related status codes

• 501 Not ImplementedThe server doesn't support the functionality (usually the HTTP method) needed to fulfill the request.
• 404 Not FoundThe server can't find anything at the requested URL.
• 400 Bad RequestThe server can't process the request because it's malformed or invalid.

Related tools

• HTTP status codes — full list
• HTTP headers reference
• cURL converter
• Mock API — fake REST endpoints with custom status codes
• Webhook tester — inspect incoming requests