What 405 means
The route is real but was called with the wrong verb, for example POST to a read-only endpoint or GET to a webhook receiver. The response must list the permitted methods in an Allow header.
Static file servers return 405 for POST to an HTML file, which is a frequent surprise when a form action points at a static page.
Common causes
- Calling an endpoint with the wrong method.
- A form or fetch() defaulting to GET where POST was intended, or vice versa.
- A CORS preflight (OPTIONS) hitting a route that does not handle OPTIONS.
How to fix it
- Read the Allow header and change the method.
- For CORS, let the framework or proxy answer OPTIONS with the right headers.
What it looks like
A typical response:
HTTP/1.1 405 Method Not Allowed Allow: GET, HEAD
The same event in an nginx access log (the status is the number after the request line):
203.0.113.7 - - [10/Sep/2026:10:12:01 +0000] "POST /api/orders HTTP/1.1" 405 153 "-" "Mozilla/5.0"
Check it with curl
-i prints the status line and headers, and -w '%{http_code}' prints only the number, which is handy in scripts and health checks. Replace the URL with yours:
curl -i -X POST -H 'Content-Type: application/json' -d '{"a":1}' https://example.com/api/orders
Compare what curl sees with what the browser sees. A different status from the same URL usually means a cache, a CDN edge or a cookie is in the way.
Investigating a run of 405s? Paste the log excerpt into Log Share to get line numbers, highlighting and an expiring link for whoever is on call with you.
Related status codes
404Not Found: The server found no resource at that URL.501Not Implemented: The server does not support the functionality needed to fulfil the request.400Bad Request: The server could not understand the request because it is malformed.
FAQ
Why does my webhook return 405 when I open it in a browser?
Browsers send GET; the webhook accepts only POST. That 405 is expected and means the URL is correct.