Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Some links on this page are affiliate links: if you buy through them we may earn a commission, at no extra cost to you.
An HTTP 405 Method Not Allowed error means the server understands the HTTP method you sent—such as GET, POST, PUT, PATCH, or DELETE—but does not permit that method for the requested URL. The safest fix is to identify the actual method and final URL, read the response’s Allow header, determine which server layer returned the error, and then correct only the relevant route, handler, proxy, CORS policy, or client request.
What a 405 error means
HTTP methods are permitted on individual resources, not necessarily across an entire website. For example, an API might allow GET /items/123 but reject POST /items/123, while allowing POST /items to create a new item.
Under RFC 9110, a 405 response should include an Allow header listing methods supported by that resource:
Free tools Windows power users keep installed
One-click scans. No signup required.
HTTP/1.1 405 Method Not Allowed
Allow: GET, HEAD, OPTIONSThe header describes the target resource at that time; it is not a universal list for every route. Real servers sometimes omit it, so a missing header does not prove that the response is not a genuine 405. A 405 is also different from 501 Not Implemented: 405 means the method is known but disallowed for this resource, while 501 generally means the server does not recognize or implement the method.
#1 Best Overall
- Dual band router upgrades to 1200 Mbps high speed internet (300mbps for 2.4GHz plus 900Mbps for 5GHz), reducing buffering and ideal for 4K stream
- Full Gigabit Ports - Gigabit Router with 4 Gigabit LAN ports, ideal for any internet plan and allow you to directly connect your wired devices
- Boosted Coverage - Four external antennas equipped with Beamforming technology extend and concentrate the Wi-Fi signals
- MU-MIMO technology - (5GHz band) allows high speeds for multiple devices simultaneously
- Access Point Mode - Supports AP Mode to transform your wired connection into wireless network, an ideal wireless router for home
Because 405 responses may be cacheable under HTTP rules, inspect cache headers and purge the relevant CDN or proxy cache if a corrected route continues to return an old response.
Start with the method, URL, and Allow header
Before changing server configuration, record the failed request:
- The HTTP method actually sent
- The complete request URL and host
- The status code
- The
Allowresponse header - Any
Locationredirect header - Request and response headers
- The response body and server, proxy, CDN, or gateway headers
In a browser, open Developer Tools, select Network, reproduce the request, and inspect Method, Status, Request URL, Response Headers, and Location. Check the frontend source as well: a fetch() call, Axios method, HTML form method, environment variable, or route parameter may be producing a different request than expected.
For an API client, check the method selector in Postman or Insomnia. In server access logs, look for the method, path, status, user agent, and—if available—the upstream response status.
Use the Allow value as an initial decision point:
Allow: GET, HEADmeans the resource is not advertisingPOST,PUT,PATCH, orDELETE.Allow: POSTmay indicate an action or submission endpoint rather than a retrieval URL.- If
Allowincludes the method that still receives 405, investigate caches, multiple server layers, route normalization, trailing slashes, host differences, or an incorrectly generated header. - If the header is absent, continue with logs and route inspection rather than assuming the error is invalid.
Allow is not the same as Access-Control-Allow-Methods. The former describes HTTP methods supported by a resource; the latter is a CORS response header used by browsers for cross-origin authorization.
Reproduce the request with curl
Testing outside the browser separates an API or server problem from frontend behavior:
Rank #2
- 【Five Gigabit Ports】1 Gigabit WAN Port plus 2 Gigabit WAN/LAN Ports plus 2 Gigabit LAN Port. Up to 3 WAN ports optimize bandwidth usage through one device.
- 【One USB WAN Port】Mobile broadband via 4G/3G modem is supported for WAN backup by connecting to the USB port. For complete list of compatible 4G/3G modems, please visit TP-Link website.
- 【Abundant Security Features】Advanced firewall policies, DoS defense, IP/MAC/URL filtering, speed test and more security functions protect your network and data.
- 【Highly Secure VPN】Supports up to 20× LAN-to-LAN IPsec, 16× OpenVPN, 16× L2TP, and 16× PPTP VPN connections.
- Security - SPI Firewall, VPN Pass through, FTP/H.323/PPTP/SIP/IPsec ALG, DoS Defence, Ping of Death and Local Management. Standards and Protocols IEEE 802.3, 802.3u, 802.3ab, IEEE 802.3x, IEEE 802.1q
curl -v https://example.com/resource
curl -i -X POST https://example.com/resource
curl -i -X PUT
-H 'Content-Type: application/json'
--data '{"name":"Example"}'
https://example.com/resourceTo inspect the methods advertised by a URL, try OPTIONS:
curl -i -X OPTIONS https://example.com/api/items/123OPTIONS can help reveal communication options, but not every application implements an informative response. Treat it as a diagnostic, not a replacement for the API contract or route table.
Be careful with curl -X. It forces a method but does not automatically provide a valid body, authentication context, CSRF token, or content type. A method-level test succeeding does not prove that the complete application request is valid.
Inspect redirects separately. First, do not follow them:
curl -i https://example.com/old-endpointThen compare the final request when redirects are followed:
curl -i -L https://example.com/old-endpointA client may send the original method to one URL and then behave differently at the redirected URL, depending on the redirect status and client. Do not change a state-changing POST to GET merely to avoid the error; that can expose data in URLs and logs or trigger the wrong operation.
Rank #3
- Dual-band Wi-Fi with 5 GHz speeds up to 867 Mbps and 2.4 GHz speeds up to 300 Mbps, delivering 1200 Mbps of total bandwidth¹. Dual-band routers do not support 6 GHz. Performance varies by conditions, distance to devices, and obstacles such as walls.
- Covers up to 1,000 sq. ft. with four external antennas for stable wireless connections and optimal coverage.
- Supports IGMP Proxy/Snooping, Bridge and Tag VLAN to optimize IPTV streaming
- Access Point Mode - Supports AP Mode to transform your wired connection into wireless network, an ideal wireless router for home
- Advanced Security with WPA3 - The latest Wi-Fi security protocol, WPA3, brings new capabilities to improve cybersecurity in personal networks
Check for the wrong endpoint or route shape
Many 405 errors are caused by using a valid method at the wrong URL. Compare the request with the API documentation, route definition, or OpenAPI document:
| Operation | Typical method | Common mistake |
|---|---|---|
| Retrieve a resource | GET |
Sending POST or PUT |
| Create or submit data | POST |
Posting to a read-only page or item URL |
| Replace a known resource | PUT |
Using an item method on a collection route |
| Partially update a resource | PATCH |
The API supports only PUT or a custom action |
| Delete a resource | DELETE |
A proxy or route policy blocks the method |
Common route mistakes include:
POST /items/123when creation expectsPOST /itemsPUT /itemswhen replacement expectsPUT /items/123- Calling a frontend page instead of the backend API
- Using
/api/iteminstead of/api/items - Using the wrong API version or base path
- Calling
/resource/when the server distinguishes it from/resource - Using a collection endpoint for an item-level operation, or vice versa
HTML forms traditionally support only GET and POST. Frameworks often emulate PUT, PATCH, or DELETE with a hidden method field or a header. A method override such as _method=PUT is application-specific, not a universal HTTP feature.
Verify the deployed API route
Inspect the route table or controller declaration in the environment serving the request. A route may:
Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minutePC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11- Never have been registered
- Support only
GETeven though the client sendsPOST - Have an incorrect verb attribute or decorator
- Fail to match because of a path parameter, slash, prefix, or route precedence
- Be blocked by middleware before the controller runs
- Exist locally but not in the deployed version
- Be forwarded to the wrong application by a reverse proxy
Illustrative declarations look like these, but the exact syntax depends on the framework:
Express: app.post('/items', handler)
Django: path('items/', view) # view must permit POST
Flask: @app.route('/items', methods=['GET', 'POST'])
ASP.NET Core: [HttpPost("items")]
Laravel: Route::post('/items', ...)Confirm the route in the deployed application, not only in source control. Check the application base path, production configuration, container image, process restart, and all nodes in a load-balanced pool. Authentication, CSRF, authorization, content type, or tenant middleware can also return 405 in some systems, even though 401, 403, 400, or 415 would often be more conventional. Inspect the response body and application logs before weakening security controls.
When an OPTIONS request gets 405: investigate CORS
For a cross-origin browser request, the browser may send a CORS preflight before the actual request. This is common for methods such as PUT, PATCH, or DELETE, and for requests using non-safelisted headers or content types. Browsers do not preflight every cross-origin request.
Rank #4
- DUAL-BAND WIFI 6 ROUTER: Wi-Fi 6(802.11ax) technology achieves faster speeds, greater capacity and reduced network congestion compared to the previous gen. All WiFi routers require a separate modem. Dual-Band WiFi routers do not support the 6 GHz band.
- AX1800: Enjoy smoother and more stable streaming, gaming, downloading with 1.8 Gbps total bandwidth (up to 1200 Mbps on 5 GHz and up to 574 Mbps on 2.4 GHz). Performance varies by conditions, distance to devices, and obstacles such as walls.
- CONNECT MORE DEVICES: Wi-Fi 6 technology communicates more data to more devices simultaneously using revolutionary OFDMA technology
- EXTENSIVE COVERAGE: Achieve the strong, reliable WiFi coverage with Archer AX1800 as it focuses signal strength to your devices far away using Beamforming technology, 4 high-gain antennas and an advanced front-end module (FEM) chipset
- OUR CYBERSECURITY COMMITMENT: TP-Link is a signatory of the U.S. Cybersecurity and Infrastructure Security Agency’s (CISA) Secure-by-Design pledge. This device is designed, built, and maintained, with advanced security as a core requirement.
OPTIONS /api/items HTTP/1.1
Origin: https://app.example
Access-Control-Request-Method: PATCH
Access-Control-Request-Headers: authorization, content-typeA suitable preflight response might be:
HTTP/1.1 204 No Content
Access-Control-Allow-Origin: https://app.example
Access-Control-Allow-Methods: GET, POST, PATCH, OPTIONS
Access-Control-Allow-Headers: Authorization, Content-TypeReproduce the preflight directly:
curl -i -X OPTIONS https://api.example.com/items
-H 'Origin: https://app.example.com'
-H 'Access-Control-Request-Method: PATCH'
-H 'Access-Control-Request-Headers: authorization,content-type'Configure the correct origin, requested method, and requested headers. Credentialed requests cannot use Access-Control-Allow-Origin: *. Do not allow every origin or method in production unless that is genuinely required. See MDN’s CORS guide for the browser rules.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Check web-server handlers, especially IIS
A 405 may be generated before the application receives the request. On IIS, Microsoft documents causes including invalid methods, a POST sent to a static-file handler, WebDAV conflicts, application-generated responses, and handler mappings that do not include the required verb.
- Identify the exact method and URL.
- Check the IIS error details and substatus, such as
405.0. - Inspect handler mappings for the target path.
- Confirm that a dynamic API path is not being handled as
StaticFile. - Check whether WebDAV is intercepting
PUT,DELETE, or related methods. - Review site-level configuration and
applicationhost.configcarefully. - Inspect failed-request tracing and application logs.
Use Microsoft’s IIS 405 guidance and, for published ASP.NET Web API applications, its verb-mapping troubleshooting documentation. Do not disable WebDAV or change global verb restrictions without confirming the cause and security impact.
With Apache or Nginx, inspect virtual-host, location, directory, rewrite, security-module, and proxy rules. Confirm that the method is forwarded unchanged and that a static-file location is not catching a dynamic API path. Review both proxy and upstream logs.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Find out whether a proxy, WAF, gateway, or CDN returned 405
The application is not necessarily the component that generated the response. Check Server, Via, X-Cache, request IDs, gateway headers, response-body branding, edge logs, and origin logs.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Scan for outdated or missing drivers - takes under a minute3Clear out junk files and repair common Windows errors- If the edge returns 405 and the origin has no matching log entry, investigate the CDN, WAF, gateway, or reverse proxy.
- If the origin logs the request and returns 405, focus on the web server, framework, route, or middleware.
- Compare behavior with and without a trailing slash and across production nodes when safe.
Check method allowlists, path-specific policies, rewrite rules, authentication gateways, and WAF rules. Identify the exact rule and narrow its scope; do not permanently bypass a WAF or suppress the error with a proxy-generated 200 OK.
Best Value
- Next-Gen Gigabit Wi-Fi 6 Speeds: 2402 Mbps on 5 GHz and 574 Mbps on 2.4 GHz bands ensure smoother streaming and faster downloads; support VPN server and VPN client¹
- A More Responsive Experience: Enjoy smooth gaming, video streaming, and live feeds simultaneously. OFDMA makes your Wi-Fi stronger by allowing multiple clients to share one band at the same time, cutting latency and jitter.²
- Expanded Wi-Fi Coverage: 4 high-gain external antennas and Beamforming technology combine to extend strong, reliable, Wi-Fi throughout your home.
- Improved Battery Life: Target Wake Time helps your devices to communicate efficiently while consuming less power.
- Improved Cooling Design: No heat ups, no throttles. A larger heat sink and redefined case design cools the WiFi 6 system and enables your network to stay at top speeds in more versatile environments.
WordPress and CMS checks
First determine whether the failing URL is a REST API route, admin endpoint, form handler, static page, or another CMS path. Then check:
- Whether the plugin or theme actually registers the requested route and method
- Permalink and rewrite configuration
- Security, firewall, membership, and caching plugins
- Host-level WAF, WebDAV, and web-server rules
- Authentication, nonce, content type, and required REST headers
- WordPress and web-server logs
Flushing permalinks can repair stale rewrite rules, but it will not create an unsupported method, fix a static-file handler, or change a WAF policy. Test changes on staging where possible, disable suspected security or caching components one at a time, and re-enable them after each test. Apply a narrow rule or route correction rather than leaving protection disabled.
405 versus nearby errors
| Response | Meaning | What to check |
|---|---|---|
404 Not Found |
Resource or route was not found | Path, host, deployment, and rewrites |
401 Unauthorized |
Authentication is required or invalid | Credentials and authentication scheme |
403 Forbidden |
Authorization or policy refuses the request | Permissions, ACLs, and security policy |
405 Method Not Allowed |
Known method is disallowed for this resource | Route, handler, proxy, and method |
501 Not Implemented |
Method is not recognized or implemented | Server capability and unsupported verb |
400 Bad Request |
Request syntax or framing is invalid | URL, headers, body, and framing |
| Browser CORS error | Browser blocked cross-origin access | Preflight response and CORS headers |
A CORS console error can conceal an underlying server response. Inspect the preflight directly instead of assuming that the API’s ordinary route returned 405.
Deployment and cache problems
If the route looks correct but the error persists, check for an old application version, an unrestarted process, a container image that was not rebuilt, a configuration change applied to the wrong virtual host, or one load-balanced node running different code.
Test with cache revalidation:
curl -i -H 'Cache-Control: no-cache' https://example.com/api/itemsA unique query string can help diagnose an intermediary cache, but should not become a permanent cache strategy:
curl -i 'https://example.com/api/items?debug_request=20260818'Compare response headers and request IDs across multiple requests and nodes. Purge a CDN or proxy cache only after confirming that it is serving the stale 405.
Apply the narrowest safe fix
- Correct the client method or URL when the API contract says the request is wrong.
- Register or correct the application route when the method should be supported.
- Map the path to a dynamic handler instead of a static-file handler.
- Correct proxy forwarding or a path rewrite.
- Configure CORS preflight for the required origin, method, and headers.
- Adjust a route-specific gateway or WAF policy after reviewing its security rationale.
- Deploy the correct version or remove a confirmed stale cache.
Avoid globally enabling every HTTP verb, changing state-changing requests to GET, removing authentication or CSRF protection, permitting all CORS origins, or automatically retrying a non-idempotent POST without considering duplicate operations. The web server accepting a verb does not mean that the application has a route for it.
Recommended Free Tools
Final 405 troubleshooting checklist
- Confirm the actual HTTP method.
- Confirm the final URL, including redirects, host, path prefix, and trailing slash.
- Read the
Allowheader. - Reproduce the request with
curl. - Compare the request with the documented route.
- Check authentication, CSRF, headers, body, and content type.
- Test CORS preflight separately if the request is cross-origin.
- Identify the responding layer: browser, CDN, WAF, gateway, proxy, web server, or application.
- Inspect route tables, handler mappings, access logs, error logs, and deployment state.
- Apply the smallest path-specific correction.
- Retest the complete authenticated browser and API workflow, including every production node when applicable.
For the standards definition and status-code behavior, see MDN’s 405 reference and RFC 9110.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
