HTTP 405 Method Not Allowed: causes and fixes

What 405 means

The URL exists, but it doesn't accept the request method you used: a POST to a page that only answers GET, or a DELETE on a read-only resource. 405 is defined in RFC 9110 §15.5.6, and the server must send an Allow header listing the methods it does support:

HTTP/1.1 405 Method Not Allowed
Allow: GET, HEAD
Content-Type: text/plain

Method Not Allowed

405 responses are cacheable by default, so a CDN can keep serving one after you fix the route; purge it if the error survives a deploy.

Common causes

The route only defines one method. A framework route registered with get() answers 405 (or 404, depending on the framework) to a POST.
A form posts to a static file. nginx answers 405 to a POST on a static .html file, because static files can't take a body.
A redirect changed the method. A 301 or 302 on a form's target makes most clients repeat the request as GET; if the new URL is POST-only, you get 405. Use 307 or 308 to keep the method, or point the form at the final URL.
CORS preflight not handled. The browser sends OPTIONS before a cross-origin PUT or JSON POST; a server that doesn't route OPTIONS rejects it.
WebDAV or security rules that block PUT, DELETE or PATCH at the web server or firewall.

How to fix it as a client

Read the Allow header: it says which methods the URL takes. Check the API docs for the right method and path, including a trailing slash that may redirect. With curl, -X sets the method and -d alone makes it a POST.

How to fix it on the server

In nginx, restrict methods deliberately and send the POST to the application, not to a static file:

location /api/ {
    limit_except GET POST { deny all; }
    proxy_pass http://app;
}

Note that limit_except answers 403, not 405. In Apache, check <Limit> / <LimitExcept> blocks and mod_security rules for the methods you need. In Express, add a catch-all after your routes so the response is a correct 405 with Allow:

app.route('/items/:id')
  .get(getItem)
  .put(updateItem)
  .all((req, res) => res.set('Allow', 'GET, PUT').sendStatus(405));

Use 405 when the server knows the method but this resource doesn't support it, and 501 Not Implemented when the server doesn't support the method at all.

405 and SEO

Googlebot fetches pages with GET, so 405 only matters for SEO when a page you want indexed rejects GET or HEAD. Google treats every 4xx except 429 the same way: the URL isn't indexed, and an indexed one drops out. Make sure public pages answer GET with 200.

404 Not Found: the URL itself doesn't exist.
501 Not Implemented: the server doesn't recognise the method at all.
308 Permanent Redirect: a redirect that keeps POST as POST.
403 Forbidden: the method is fine, but you aren't allowed.

To see what a URL answers to a given method, send it with the HTTP Request Builder, or follow its redirects with the Redirect Checker.