HTTP Status Codes

405 Method Not Allowed

The resource exists but does not support the HTTP method used. The response must list the permitted methods in an Allow header.

What it means

405 Method Not Allowed means the target understands the method but does not permit it here — e.g. a DELETE on a read-only resource. The server must include an Allow header enumerating the methods that are supported.

HTTP RESPONSE
HTTP/1.1 405 Method Not Allowed
Allow: GET, HEAD, OPTIONS

Why it matters

  • The Allow header tells clients exactly which methods to use, making the error self-correcting.
  • It cleanly separates 'wrong method' from 'wrong URL' (404) and 'not permitted' (403).

Common mistakes

  • Returning 405 without the mandatory Allow header.
  • Using 404 when the URL exists but the method is unsupported.

How WebInspect checks this

  • The API Inspector checks method handling and whether 405 responses advertise Allow.