405 Method Not Allowed - HTTP Status Code

Meaning & Description

The 405 Method Not Allowed status code indicates that the server knows the requested HTTP method (e.g., GET, POST, DELETE), but the target resource does not support it. The server MUST generate an `Allow` header in a 405 response containing a list of the target resource's currently supported methods.

Common Causes

Using `GET` instead of `POST` for form submissions
Misconfigured reverse proxies dropping specific HTTP verbs (like `PUT` or `DELETE`)
Missing route handlers in backend frameworks (e.g., defining `app.get()` but not `app.post()`)
REST APIs strictly enforcing allowed operations on specific resources

How to fix a 405 error

Check the `Allow` response header to see which HTTP methods are permitted.
Verify that your HTTP client is using the correct verb (e.g., PUT vs POST).
Ensure your server-side router has a handler registered for the method.
Check CDN or WAF settings to ensure methods like DELETE or PATCH are not being blocked at the edge.

Browser & SEO Behaviour

Browser Behavior

Modern browsers will display a generic error page. When caused by a form submission, the browser stops and shows an error.

SEO Impact

If crawlers try to POST or PUT (which is rare), they receive a 405. For normal GET requests, 405 indicates a serious configuration issue that will harm SEO if crawlers cannot read the page.

CDN Behavior

May cache the 405 response for the specific unsupported method, but will not impact caching for supported methods like GET.

Code Examples

Node.js (Express)

app.get('/api/users', (req, res) => {
  res.json({ users: [] });
});

// Catch-all for unsupported methods on this route
app.all('/api/users', (req, res) => {
  res.set('Allow', 'GET, OPTIONS');
  res.status(405).json({ error: 'Method Not Allowed' });
});

Python (FastAPI)

# FastAPI automatically handles 405 errors if a route 
# is defined for one method but accessed with another.
from fastapi import FastAPI

app = FastAPI()

@app.get("/items")
def get_items():
    return [{"item": "apple"}]
# A POST request to /items will automatically return 405.

Go (net/http)

func handler(w http.ResponseWriter, r *http.Request) {
    if r.Method != http.MethodPost {
        w.Header().Set("Allow", "POST")
        http.Error(w, "Method Not Allowed", http.StatusMethodNotAllowed)
        return
    }
    // Handle POST request
}

C# (ASP.NET Core)

// ASP.NET Core returns 405 automatically if an endpoint 
// is restricted by attributes like [HttpGet] and 
// is called via POST.
[HttpGet("data")]
public IActionResult GetData()
{
    return Ok("Data");
}

curl

curl -i -X DELETE https://api.example.com/readonly-data

Raw HTTP Response Example

HTTP Response

HTTP/1.1 405 Method Not Allowed
Allow: GET, HEAD, OPTIONS
Content-Type: application/json
Content-Length: 42

{
  "error": "Method DELETE not supported"
}

Real-world Examples

REST APIs: Almost all strict REST APIs return 405 when a resource URL is valid but the method is wrong (e.g. POST to an ID endpoint).

Nginx: Returns 405 if trying to POST to a static HTML file.

S3: Returns 405 when attempting an unsupported HTTP operation on an object.

Frequently Asked Questions

What is the difference between 404 and 405?

404 means the URL does not exist at all. 405 means the URL exists, but the HTTP method (GET, POST, etc.) you used is not allowed on it.

Why am I getting a 405 on a static HTML file?

Web servers like Nginx or Apache generally do not allow POST requests to static files (like .html). You can only GET them.

What header is required with a 405 response?

The HTTP specification requires an `Allow` header to be sent with a 405 response, listing the methods that are actually supported by the resource.

Can a CORS preflight cause a 405?

Yes, if the preflight `OPTIONS` request fails because the server does not support the requested method, it may result in a CORS error, sometimes masked or accompanied by a 405.

How do I fix a 405 error?

Change the HTTP method in your request (e.g., from GET to POST) to match what the server expects, or update the server code to handle the method you are sending.

Did You Know?

The `Allow` header is one of the few headers that is strictly mandated by an HTTP specification for a specific status code.

Many web application frameworks automatically generate 405 responses by analyzing your defined routes without you needing to write code.

Developer Tips

Always ensure your framework automatically populates the `Allow` header when returning a 405. If it doesn't, you must add it manually.
Do not confuse 405 with 501 Not Implemented. 405 means the method is recognized by the server but rejected by the resource. 501 means the server completely lacks the ability to understand the method.
If you are migrating an endpoint from POST to PUT, consider leaving a handler that returns 405 with a descriptive message to guide API consumers.

Interview Questions

These are questions you might face in a backend or API design interview that touch on HTTP 405.

What is the mandatory header in a 405 Method Not Allowed response?

The `Allow` header is mandatory. It must contain a comma-separated list of the HTTP methods that the requested resource supports.

How is 405 different from 501 Not Implemented?

405 means the server understands the method (like POST) but the specific endpoint doesn't support it. 501 means the server doesn't recognize the HTTP method at all (e.g., a completely custom or obscure verb).

If a client sends a GET request to an endpoint that only accepts POST, should you return 404 or 405?

You should return 405 Method Not Allowed. The resource URL exists, so 404 is incorrect. 405 accurately conveys that the URL is valid but the GET method is rejected.

Common Interview Mistakes

Saying 405 means the endpoint does not exist (that is 404).
Forgetting the requirement of the `Allow` header.
Confusing it with CORS errors, which are related but distinct from the pure HTTP 405 semantic.