Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

So I have lighttpd installed and the site it runs only needs to respond to GET requests.

I was wondering how I can return 405 responses with Allow: GET headers to anything but GET requests using lighttpd?

I've had a quick google but even the lighttpd doesn't turn up anything solid.


Limiting by $HTTP["request-method"] works a treat.

Unfortunately when you use url.access-deny lighttpd sets the status code and headers as a fixed thing (403 status), regardless of if you try to add header before or after.

End result:

$HTTP["request-method"] =~ "^(PUT|HEAD|PATCH|DELETE)$" {
    url.access-deny = ( "" )
share|improve this question
up vote 2 down vote accepted

Since version 1.4.19, you can filter on request-method:

$HTTP["request-method"] =~ "^(PUT|POST|HEAD|PATCH|DELETE)$" {
  url.access-deny = ("")
share|improve this answer
I think you've got a typo in the regex there - "[" instead of "|". – nickgrim Nov 12 '12 at 11:28
@nickgrim good catch ! thx – j0k Nov 12 '12 at 11:38
Works a treat in blocking so have accepted, but it does not return a 405, but a 403 instead (I guess who cares at the end of the day). – Sam Nov 12 '12 at 17:07
@Sam That's right, but I don't know how to send a custom HTTP code. Maybe with mod_setenv. – j0k Nov 12 '12 at 17:16
@j0k ah didn't know about that module, will give it a go. Thanks for the help! – Sam Nov 12 '12 at 17:30

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.