← All articles
Web Security 2026-02-17 · 4 min read

Risky HTTP Methods: Why PUT, DELETE and TRACE Should Be Disabled

HTTP defines several request methods beyond the everyday GET and POST. Most public web servers only need GET, POST and HEAD — yet many leave others enabled, widening the attack surface.

The methods that matter

  • PUT / DELETE — can let an attacker upload or remove files if write access is misconfigured.
  • TRACE / TRACK — can be abused in cross-site tracing attacks to steal headers.
  • OPTIONS — harmless in itself but reveals which methods are allowed.

How to lock down

Restrict your server to the methods your application actually uses. In Apache use <LimitExcept GET POST HEAD> with Require all denied; in Nginx return 405 for anything outside an allowlist. The web scan reports exactly which methods your server answers.

Put this into practice
Run a free, private scan — no login, nothing stored.
🛡 Web Scan 🔒 SSL/TLS 📬 MX & Email 🎣 URL Check

Related articles

Web Security What Is a Web Application Firewall (WAF) and Do You Need One? A WAF filters malicious traffic before it reaches your app. Learn what it catches, what it does not, and when it is worth it. Web Security Open Ports: What They Reveal and Which Ones to Close Every open port is a potential door. Here is how to think about port exposure and reduce your attack surface. Web Security CVEs and Outdated Software: Why Version Numbers Matter A known vulnerability in an unpatched server is the easiest way in for attackers. Here is how CVEs work and how to stay ahead.