A 405 Method Not Allowed response means the server recognized your HTTP method but will not use it for that particular URL. The fastest fix is to identify which component generated the response, inspect the matched Nginx location, and then correct the method restriction, routing fallback, proxy forwarding, or WebDAV configuration. Start by recording the request method, URI, response headers and status; do not assume that a working GET proves that POST, PUT, PATCH, OPTIONS or DELETE is configured correctly.
Antihost offers Linux VPS plans with full root access, unlimited traffic on a 1 Gbps port and a 14-day free trial.
What a 405 response means
HTTP 405 is a resource-specific method decision. For example, an application may support GET /api/items while rejecting POST /api/items, or Nginx may route the POST to a static handler that cannot process it. The method itself is known, but the target resource does not support it.
As an Amazon Associate I earn from qualifying purchases.
The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →RFC 9110 requires the origin server to include an Allow header in a 405 response. That header lists the methods currently supported by the target resource. Capture it before changing configuration; it is usually the clearest indication of what the responding component believes is valid. Treat the header as a diagnostic clue, not as a reason to enable every method: the list may describe an upstream route, a static resource, or a deliberately restricted location.
A 405 is different from these common statuses:
| Status | Meaning | Typical implication |
|---|---|---|
| 401 | Authentication is required or failed | Credentials or an authentication policy are involved. |
| 403 | Request is understood but forbidden | Authorization, access rules or filesystem permissions may be blocking it. |
| 404 | Target resource was not found | The URI or routing may be wrong. |
| 405 | Known method is not supported for this resource | Inspect method gates, location matching and upstream behavior. |
| 501 | Method is not implemented | The server does not recognize or implement the method at all. |
Authentication can still be part of a larger failure, but changing credentials will not by itself make an endpoint accept a method that its route does not support. Likewise, a missing file is normally a 404 concern; a 405 says the server recognized the method but declined it for the selected resource.
#1 Best Overall
- [Ultra-Lightweight Ear Buds Designed for Small Ears] Each earbud weighs only 3.7g and features a compact, ergonomic in-ear design made especially for small ears. Secure, low-profile, and comfortable for workouts, all-day wear or overnight sleeping.The ultra-slim profile sits flush in your ear with no hard edges poking or rubbing, so you can even sleep on your side without discomfort.
- [Immersive Stereo Sound with TOZO OrigX Technology] TOZO OrigX tuning delivers clear vocals, balanced mids, and natural stereo sound for music, podcasts, and videos.
- [Long Battery Life for Daily Use] Get up to 7 hours of playtime on a single charge, with up to 32 hours total using the charging case—ideal for workdays, commuting, and extended listening sessions.
- [Bluetooth 5.3 & Stable Connection] Bluetooth 5.3 provides fast pairing, stable wireless performance, and reduced dropouts as you move around home or office.
- [Deep Bass with Clear Vocals] High-performance drivers produce punchy bass while keeping vocals clean and detailed for everyday listening.
The distinction between 405 and 501 matters when diagnosing unusual verbs. A recognized method that is unsupported at this resource is the 405 case. A method the origin does not recognize or implement should result in 501. If a custom gateway returns a different status, use the actual response and logs to identify that component rather than assuming Nginx is responsible.
First determine who returned the 405
Nginx can generate a 405, or it can pass through a 405 produced by an application server. The repair differs, so establish the response boundary first.
Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Repair Windows errors before they cause bigger problemsFix Now →Capture the complete response
Use a minimal request that preserves the failing method and URI. For a body-bearing request, include the same content type and representative body used by the client.
curl -i -X POST https://example.test/api/items
-H 'Content-Type: application/json'
--data '{"name":"sample"}'Record the status line, Allow header, Server header, final URI and redirect behavior. Repeat with the exact failing method—do not substitute GET merely because GET is convenient. Also note whether the client followed a redirect: a redirected request can arrive at a different path or use a different method, obscuring the original failure.
Compare public and direct-upstream requests
When it is safe to do so, send the same request directly to the upstream application from the Nginx host or an approved diagnostic network. A 405 only at the public URL points toward Nginx routing or policy. A 405 from both paths points toward the application route or its own method policy. Never expose a private upstream merely to perform this test, and use a non-destructive endpoint or test data for write requests.
Use both logs
Compare the Nginx access-log status with the application log at the same timestamp and request identifier. If the application has no corresponding request, Nginx likely rejected or rerouted it before proxying. If it logged the request and returned 405, inspect the application route and the headers and method it received. A status in the access log alone does not prove which layer generated it; correlate the request path, method and response timing.
Inspect the Nginx location that actually matches
Nginx chooses among exact, prefix and regular-expression locations. The block you edit may not be the block handling the failing URI. Review the active server configuration, including included snippets, and determine the winning location for the exact path. Check the selected server block as well: host name, port and TLS settings can direct the request to a different configuration than the one you opened.
Rank #2
- 【IP68 Waterproof Multifunctinal Smart Watch】Torjalph fitness activity tracker smart watch is IP68 waterproof technology ,you can wear it when swimming,handwashing,it's rain-proof which means that you perform multiple exercise modes outside without worrying about sweat or rain corroding your fitness smart watch,and this watch equipped with a 230 mAh large capacity battery magnetic charging ,and this sports activity tracker watch can be used 5-7 days If fully charged.
- 【Larger 1.83'' Full Screen Watch & Multi-dial Selection】1.83 inch full HD color touch screen smart watch for men / women provides excellent 240*284 resolution image quality ,This Bluetooth smart watch offers a better touch experience and remarkable immersion and ,more than 200 watch faces for you to choose from App"Da Fit ", you can change the dial style according to your mood to wear keeping the world on your wrist
- 【Accurate Activity Tracker Smart Watch 】sports watch activity tracker uses sweat and dust resistant breathable silicone strap, our Fitness Tracker Smart Watch for Android iOS Phones supports 12 sports modes,walking,running,bicycle,swimming,badminton,basketball,football,rope skipping. This bluetooth calls smart watch for men women is lightweight and stylish, bringing more convenient and relaxing sports experience while also providing more protection.
- 【Your 24 Hour Personal Daily Health Monitor】Fitness watch for women men full touch screen IP67 waterproof bluetooth smartwatch for Android iOS Phones with heart rate blood pressure monitor multifunction Andriod smart watch with steps counter sleep monitor sports fitness watch, monitoring blood oxygen saturation allows you to understand your physical condition in real time to track fitness progress ,to know your health status in time.
- 【More Functions Bluetooth Call Smart Watch】This fitness activity smart watch full screen for iPhone and Android phones includes a bunch of new features including:The bluetooth smart watch can hang up the phone, receive and display WhatsAPP /Text /Facebook /Twitter /Messenger reminder.Support sedentary reminder, alarm clock, stopwatch, timer,weather information,music control, remote camera control compatible with Android 5.0 and above or iOS 9.0 and above smartphones.
Look for explicit method gates
The limit_except directive limits methods inside a location. A rule such as this permits only the listed methods and denies the rest:
location /api/ {
limit_except GET POST OPTIONS {
deny all;
}
proxy_pass http://backend;
}This pattern is appropriate only when the endpoint contract really is GET, POST and OPTIONS. Add PUT, PATCH or DELETE only when the application and security policy require them. Search for limit_except, deny, return 405, rewrites and included configuration fragments. A method may be blocked in a parent or more specific location even when the visible API block appears permissive.
Remember that limit_except is a method boundary, not an authentication substitute. Its rules can be combined with the access controls appropriate to the location, but write methods should still be authorized by the application or another deliberate security layer. Keep the allowed set explicit so future changes do not silently expose operations.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Scan for outdated or missing drivers - takes under a minute3Repair Windows errors before they cause bigger problemsCheck method handling outside limit_except
Look for rewrite targets and named locations that send the request elsewhere. A rewrite can move a POST into a location intended for static files or a route that accepts only GET and HEAD. Also check whether a separate server block is selected because of the host name, port or TLS configuration. Included snippets from a distribution, control panel or security package can contain method restrictions that are not visible in the main file.
Validate before reloading
After changes, run the configuration test command provided by your distribution, commonly:
nginx -tOnly reload after the test succeeds. Use the service manager appropriate to the host, then replay the original request with its original body and headers. A syntax test confirms that Nginx can load the configuration; it does not confirm that the intended location wins, so functional replay and log correlation remain necessary.
Prevent an API request from falling into a static fallback
A frequent cause of “GET works, POST gets 405” is a broad single-page-application rule:
Windows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallOutdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchRank #3
- [Low Noise High Fidelity] New bee guitar cord with 22AWG oxygen-free-copper center conductors provides enhanced signal transfer, the PVC insulation material and the high-density stranded copper double shield provide noise rejection for quiet operation
- [Ideal for Choice] New bee 1/4 straight and right angle metal connectors, ensures a secure connection in any instrument, pedal, or amp jack. L shape great fro on stage guitar stands
- [Wide Compatible] Suitable for mixer, power amplifier, microphone, effector, decoder, equalizer, electoronic organ, electric guitar, electric bass and other electronic equipments. Widely used in the installation of smart home, karaoke speaker, professional stage audio, etc
- [Easy Disassemble] Making incidental repairs quick and easy! Very nice, flexible cable
- [Dont Hesite to Order] 24 hours customer services and professional technology team are standing by
location / {
try_files $uri $uri/ /index.html;
}try_files checks files and directories and internally redirects when it finds a match. If no candidate resolves, it uses the final fallback parameter or configured status. An API request that reaches a static handler can therefore fail even though the upstream API supports the method. The browser may load the front-end successfully while an API client receives a method error from the same host.
Give API, upload and WebDAV paths a more specific location so they are proxied before the broad static rule:
location ^~ /api/ {
proxy_pass http://backend;
}
location / {
try_files $uri $uri/ /index.html;
}Confirm the URI contract
Ensure that the location prefix, trailing slash behavior and upstream path match the application’s route. Depending on the form of proxy_pass, Nginx may preserve or replace part of the matching URI. A request can reach the application at a different path than the browser displayed, producing an application-level 405. Test the exact path, including any version prefix, query string and trailing slash expected by the application.
Keep static and write endpoints separate
Do not let file-serving rules handle form submissions, JSON APIs, uploads or DAV operations. Separate locations make method policy, body handling and access controls visible and reduce accidental exposure of write operations. If an endpoint intentionally serves both a document and an API, define the routing contract explicitly instead of relying on a fallback that happens to work for GET.
Verify proxy forwarding to the application
For a reverse proxy, proxy_pass chooses the upstream destination. The related directives can alter what the upstream receives:
proxy_methodcan override the request method. Remove an unintended override so the original method reaches the application.proxy_pass_request_bodycontrols whether the request body is sent upstream. A missing body can make an otherwise valid POST or PUT fail at the application.proxy_pass_request_headerscontrols request-header forwarding. Content type, authorization and conditional headers may be required by the route.
The defaults are often suitable, but verify them when a custom snippet, security include or inherited setting is present. Compare the method, body length, content type, authorization state and relevant headers in Nginx and application logs. A proxy can return a successful response for one method while silently changing or omitting data needed by another. Check request-size and buffering settings separately if the application reports an incomplete body, but do not treat a body problem as proof that the method itself is unsupported.
Distinguish upstream and Nginx response headers
The Server header is a clue, not conclusive proof, because proxies can modify it. Combine headers with access logs and an upstream replay. If the upstream itself sends 405, fix its route or allowed-method list; do not weaken Nginx restrictions as a workaround. Conversely, if the upstream never sees the request, changing application code cannot repair a proxy-side method gate or location mismatch.
Rank #4
- Digital Family Calendar: BSIMB digital calendar wall touch screen puts an end to your chaotic life. Designed for busy families, the digital calendar keeps you organised and in step with your family. Assign different colours and tasks to each family member to make family scheduling easier and more intuitive.
- Easy Setup and Auto-Sync: Plug in, connect to WLAN and auto-syn your electric calendar in minutes. Digital wall calendar compatible with Google calendar, iCloud calendar, Outlook calendar, Cozi calendar and Yahoo calendar. Add events directly on the device or through the ecalendar app. Electronic calendar stays current whether you're at work or traveling—no manual updates needed.
- All-In-One Home Assistant: Smart calendar builds habits and encourage independence with personalised chores. Display daily meal plan to reduce the daily ‘What's for dinner?’ stress. To-do lists keep track of everything you want. Turning chores into valuable achievements with stars and rewards, making life easier and more enjoyable.
- Manage Anytime Anywhere: BSIMB electronic calendar for family stay connected with the powerful ecalendar app. Access and manage your digital wall calendar anytime, anywhere with free features like stars & rewards, photo screensaver, chore charts, meals plans, to-do lists etc. Electronic planner paid features like Magic Import tailor advanced tools for users with special needs.
- Stay in Touch with Loved Ones: Share photos or videos from your phone to electronic wall calendar with app, instantly update your life moment, and keep in touch with your family, especially those who are far away; you can also surprise your smart calendar digital wall by sending him a wish card; it's also great for keeping tech-illiterate elders in touch with the youngsters.
Configure WebDAV deliberately
WebDAV uses methods beyond ordinary browser traffic, including PUT, DELETE, MKCOL, COPY and MOVE. Nginx handles these through the optional ngx_http_dav_module, which is not built by default. A build without that module requires a package or build that includes --with-http_dav_module.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Check module availability
Confirm that the installed Nginx build contains the DAV module before relying on DAV directives. Distribution packaging differs, so use the package’s documented build information rather than assuming every Nginx binary supports it. If the module is unavailable, installing or selecting a build that includes it is a prerequisite; adding directives to an otherwise valid-looking location cannot provide DAV processing by itself.
Use an explicit DAV location
location /dav/ {
root /data/www;
dav_methods PUT DELETE MKCOL COPY MOVE;
create_full_put_path on;
dav_access user:rw group:rw all:r;
}This is a pattern from the Nginx module reference, not a drop-in security policy. Adapt the root, methods and permissions to the application. Permit only the operations clients need; write methods can create, replace, move or delete data. Keep the DAV location distinct from a general static fallback so the intended methods and storage path are unambiguous.
Account for parent directories and permissions
create_full_put_path on; allows missing directories in a PUT path to be created, subject to the worker account’s filesystem permissions. Verify ownership, mode bits, parent-directory behavior and storage boundaries. A DAV request that passes method checks can still fail because Nginx cannot create or modify the target path. Test both an existing file and a new nested path, and verify that DELETE, COPY and MOVE stay within the intended root.
Use limit_except as an additional boundary
If DAV is combined with other operations, use a narrowly scoped limit_except block and authentication or network controls appropriate to the deployment. Do not expose unrestricted PUT or DELETE merely to eliminate a 405. Confirm that clients receive the intended status for unsupported DAV methods and that the Allow header reflects the methods enabled for the resource.
Recommended Free Tools
Fixes matched to the failure pattern
| Observed pattern | Likely cause | Investigation or repair |
|---|---|---|
| GET succeeds; POST fails before the app logs a request | Method restriction or static location captured the request | Inspect location selection, limit_except, rewrites and try_files; proxy the API location directly. |
| GET succeeds; POST reaches the app and returns 405 | Application route does not implement POST at that URI | Check the app’s route, path rewriting and its own allowed-method policy. |
| PUT or DELETE returns 405 on a DAV path | DAV module or method list is missing | Verify module availability and configure the required dav_methods in the intended location. |
| OPTIONS returns 405 while browser requests fail | Preflight method is blocked | Permit OPTIONS only where the cross-origin policy and application contract require it, and ensure the request reaches the correct handler. |
| Method works at the upstream but not through Nginx | Proxy override, location mismatch or body/header suppression | Check proxy_method, request-body/header directives, URI replacement and the selected server block. |
When two repairs appear possible, compare them by the component generating the response, the exact method set required, location specificity and fallback behavior, preservation of the request body and headers, DAV module availability, and the security exposure created by write methods. The smallest change that routes the required method to the correct handler is generally safer than a broad allow rule.
Retest safely after the change
- Save the original failing method, URI, query string, headers and body.
- Run
nginx -tand correct every reported syntax or include error. - Reload Nginx through the host’s service manager only after validation succeeds.
- Replay the same request with
curl -ior the original client. - Check the status and
Allowheader, then correlate Nginx and upstream logs. - Test neighboring methods deliberately: GET, HEAD, OPTIONS and each required write method. A successful GET alone does not validate a POST, PUT, PATCH or DELETE route.
- For write operations, verify the intended side effect and confirm that an unauthorized method remains denied.
Remove temporary diagnostic verbosity and direct-upstream access when the investigation is complete. Keep the final method set as narrow as the endpoint requires. Record the selected location and the reason for each enabled method so a later configuration change does not reintroduce the same failure.
Security checks before allowing write methods
- Allow only methods used by the endpoint; do not use a blanket “allow all” rule.
- Require authentication and authorization at the appropriate layer for state-changing operations.
- Protect WebDAV paths from unintended public access and verify filesystem permissions.
- Preserve request bodies and authorization headers intentionally, not through copied snippets whose behavior is unknown.
- Review CORS and OPTIONS handling separately from write-method authorization.
- Log method, URI, status and an identifier that lets you correlate proxy and application events without recording sensitive request bodies.
OPTIONS is often needed for a browser’s cross-origin preflight, but permitting it does not authorize the subsequent POST, PUT or DELETE. Make the preflight response and the actual route agree about allowed methods, headers and credentials. Test from the same origin and cross-origin contexts used by clients.
When the right fix is in the application
If the request reaches the upstream with the expected method, URI, headers and body, and the upstream returns 405 with an appropriate Allow header, Nginx is doing its forwarding job. The application route must then be changed, or the client must use one of the methods that route supports. Conversely, if Nginx returns 405 before the upstream sees the request, changing application code cannot solve the proxy’s method policy or location selection.
Frequently Asked Questions
Why does a browser GET work while my API POST returns 405?
GET may be handled by a static location or a route that explicitly supports it, while POST is being denied by a method gate, captured by a try_files fallback, or rejected by the upstream route. Compare the POST in Nginx and application logs and inspect the Allow header.
Should I add every method to limit_except?
No. List only methods required by that resource and its documented contract. Adding write methods unnecessarily increases exposure and can permit unintended changes.
Can Nginx proxy a method it does not list in a location?
A proxy location can forward methods unless another directive or location rejects them, but the upstream must also implement the method. Check for limit_except, return 405, rewrites and proxy overrides before changing the method list.
Why do WebDAV PUT and DELETE still fail after I add dav_methods?
The installed build may lack ngx_http_dav_module, the request may match a different location, or filesystem permissions and parent-directory creation may prevent the operation. Verify the active location, module availability and storage permissions.
Free tools Windows power users keep installed
One-click scans. No signup required.
What does the Allow header tell me?
It lists the methods the responding origin says are currently supported for that resource. Capture it with the exact failing request, then determine whether the list came from Nginx or the upstream application before changing configuration.
Why is OPTIONS returning 405 even though POST is enabled?
OPTIONS may be matched by a different location or blocked by limit_except, while POST reaches the API. Permit OPTIONS only when the endpoint and cross-origin policy require it, and verify that the preflight reaches the intended handler.
Do I need to rebuild Nginx for WebDAV?
Only if the installed package or build lacks ngx_http_dav_module. The module is not built by default; a build that includes --with-http_dav_module or a distribution package providing it is required for Nginx’s DAV directives.
The Bottom Line
Find the response boundary first, then inspect the winning location, method restrictions, static fallbacks and proxy forwarding. Enable only the methods the endpoint actually needs, configure WebDAV only with the required module and permissions, validate with nginx -t, and retest the original request while correlating both logs.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
