So I have lighttpd installed and the site it runs only needs to respond to GET requests.

I was wondering how I can return 405 responses with Allow: GET headers to anything but GET requests using lighttpd?

I've had a quick google but even the lighttpd doesn't turn up anything solid.


Limiting by $HTTP["request-method"] works a treat.

Unfortunately when you use url.access-deny lighttpd sets the status code and headers as a fixed thing (403 status), regardless of if you try to add header before or after.

End result:

$HTTP["request-method"] =~ "^(PUT|HEAD|PATCH|DELETE)$" {
    url.access-deny = ( "" )

1 Answer 1


Since version 1.4.19, you can filter on request-method:

$HTTP["request-method"] =~ "^(PUT|POST|HEAD|PATCH|DELETE)$" {
  url.access-deny = ("")
  • 2
    I think you've got a typo in the regex there - "[" instead of "|".
    – nickgrim
    Nov 12, 2012 at 11:28
  • @nickgrim good catch ! thx
    – j0k
    Nov 12, 2012 at 11:38
  • Works a treat in blocking so have accepted, but it does not return a 405, but a 403 instead (I guess who cares at the end of the day). Nov 12, 2012 at 17:07
  • 1
    @Sam That's right, but I don't know how to send a custom HTTP code. Maybe with mod_setenv.
    – j0k
    Nov 12, 2012 at 17:16
  • @j0k ah didn't know about that module, will give it a go. Thanks for the help! Nov 12, 2012 at 17:30

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.