HTTP Method Not Allowed

What It Means

This request used an HTTP method (verb) that is not currently authorized by the WAF.

Why It Matters

The WAF controls which HTTP methods are allowed to reach your application. Standard methods like GET, POST, and HEAD are always permitted. Other methods such as PUT, DELETE, PATCH, OPTIONS, and TRACE can be individually allowed or blocked. Restricting unused methods reduces your attack surface.

Common Triggers

Requests using HTTP methods that are not enabled in your WAF configuration. New WAFs allow PUT, PATCH, DELETE, and OPTIONS by default (GET, POST, and HEAD are always permitted), so on a default configuration this block usually means an uncommon method like TRACE or CONNECT was used to probe for vulnerabilities, or a WebDAV verb was attempted. If a standard method is being blocked, it was disabled at some point after setup.

What To Do

If a method your application needs is being blocked, re-enable it on the Traffic Rules > HTTP Methods page of your WAF dashboard. See How WAF Blocking Works for details on HTTP verb filtering. Do not enable methods your application does not actually use.