405 Method Not Allowed: what it means and how to fix it

Kofi Agyem, Founder and CEO, CloudzyroPublished November 1, 2026 · 5 min read

On this page

1. The short answer
2. What you'll see
3. Common causes
4. How to fix a 405 as a visitor
5. How to fix a 405 on your own site
6. On Cloudzyro
7. How to check the status code
8. Related errors
9. Sources

A 405 Method Not Allowed means the address exists but doesn't accept that kind of request, like a POST to a static page. Causes and fixes by server.

1. The short answer

A 405 Method Not Allowed error means the address exists, but it doesn't accept the kind of request you sent, such as a POST to a page that only accepts GET. It nearly always comes from how a site is built: a form posting to a static page, an API route without a handler for that method, or a redirect that changed the method.

Every HTTP request has a method: GET to fetch, POST to send data, PUT, PATCH and DELETE to change things, OPTIONS to ask what's allowed. A 405 response must include an Allow header listing the methods that address does accept.

2. What you'll see

"405 Not Allowed" from nginx, "405 Method Not Allowed" from Apache or an app, or, in the browser console, a CORS error whose real cause is a 405 to the preflight OPTIONS request.

3. Common causes

A form posting to a static site or file. nginx and many static hosts answer 405 to a POST for a static file. There's no code there to receive the data.
A missing handler. The API route only exports GET, and the client sends POST.
A redirect turned POST into GET. A form posts to http:// or to /contact without a trailing slash, the server answers 301 or 302, and the browser follows it with a GET, which the target may refuse or ignore.
CORS preflight not handled. The browser's OPTIONS request isn't answered.
Methods switched off on purpose, such as PUT and DELETE on Apache, or WebDAV turned off.
A security rule in a firewall or ModSecurity that only allows GET and POST.

4. How to fix a 405 as a visitor

Go back, reload the page that has the form, and submit again.
Make sure you're on the site's main address (with https://), not an old bookmark.
If it keeps happening, tell the site owner which form or button fails. There's little else a visitor can do.

5. How to fix a 405 on your own site

Check the `Allow` header first: it tells you what the address accepts. Then check the method your page or client really sends in the browser's Network tab.

Static sites. A static site can't receive form submissions. Send the form to an app or API that can (your own server route, or a form service), not to a .html page.

nginx. POST to a static file gives 405 Not Allowed. Route form posts to the app with proxy_pass or fastcgi_pass instead of serving a file.

Apache and cPanel hosting. Check .htaccess and the server config for <Limit> or <LimitExcept> blocks and for Require method rules. A PHP script that handles the form should be the form's action, and should check $_SERVER['REQUEST_METHOD'].

Node and Express. Express answers an unmatched method with 404 ("Cannot POST /path"), not 405. Add the handler, or answer 405 with an Allow header yourself. For CORS, the cors middleware handles OPTIONS preflights.

// Express: say clearly which methods a route accepts
app.route("/api/items")
  .get(listItems)
  .post(createItem)
  .all((req, res) => res.set("Allow", "GET, POST").sendStatus(405));

Next.js. In the App Router, a route handler (route.ts) answers 405 for any method it doesn't export. Export a function named after the method you need, such as export async function POST(request) { ... }.

Redirects on forms. Point the form's action at the final address, with https:// and the right trailing slash. If you must redirect a POST, use 307 or 308, which keep the method; see 301 vs 302 redirects.

WordPress. Firewalls and security plugins sometimes block methods like PUT and DELETE, which the block editor and REST API use. Check their logs if saving posts fails with 405.

Cloudflare. Cloudflare passes standard methods through; a 405 with Cloudflare branding is usually your server's answer, so look at your server's log for the request.

6. On Cloudzyro

On Sites & Apps, a static site is files only, so a contact form needs somewhere to send its data: deploy it as a Node app with a route that accepts POST, or use a form service. Keep any secret keys the route needs in environment variables, not in the page.

7. How to check the status code

# Try a POST and see the status and the Allow header
curl -i -X POST https://www.example.com/contact

# Ask which methods are allowed (if the server supports OPTIONS)
curl -i -X OPTIONS https://www.example.com/api/items

In the browser's Network tab, check the Method column next to Status. A form submission that shows a 301 followed by a GET is the redirect problem above.

[404 Not Found](/guides/what-is-a-404-error): no route at all (Express uses 404 for wrong methods too).
[403 Forbidden](/guides/403-forbidden-error): the method is fine, but you're not allowed.
[400 Bad Request](/guides/400-bad-request): the right method, but a malformed request.
501 Not Implemented: the server doesn't support the method anywhere.

9. Sources

Questions

What does 405 Method Not Allowed mean?

The server knows the address, but it doesn't accept the HTTP method used, for example a POST to a page that only answers GET.

Why does my form give a 405 error?

Usually the form posts to a static page or a file, which can't receive data, or it posts to an address that redirects, and the redirect turned the POST into a GET.

What is the Allow header?

A response header listing the methods the address does accept, such as GET, HEAD. RFC 9110 says a 405 response must include it.

Why does my API return 405 for OPTIONS?

Browsers send an OPTIONS request before some cross-origin calls (a CORS preflight). If the server doesn't handle OPTIONS, it answers 405 and the browser reports a CORS error.

What's the difference between 405 and 501?

405 means the server knows the method but this address doesn't allow it. 501 Not Implemented means the server doesn't support the method at all.

Is a 405 error the visitor's fault?

Almost never. It's how the site's form, link or code was built. Visitors can try reloading the page before submitting again, but the fix belongs to the site owner.