Skip to content
Skip to content
API Pricing RU Sign In
← All HTTP Headers
CORS

Access-Control-Allow-Methods

Specifies which HTTP methods are allowed in a CORS preflight response.

Syntax

Access-Control-Allow-Methods: <method>, <method>

Example

Access-Control-Allow-Methods: GET, POST, PUT, DELETE, OPTIONS

Description

Access-Control-Allow-Methods is used in CORS preflight responses to indicate allowed HTTP methods for cross-origin access.

Common values: GET, POST, PUT, DELETE, PATCH, OPTIONS. Preflight is sent for non-simple methods or custom headers.

Only list methods your API supports. Extra methods expand the attack surface.

Check if your website sends this header correctly

Check your headers →

Related Articles

HTTP Methods Explained: GET, POST, PUT, DELETE and Beyond
A comprehensive guide to HTTP methods — GET, POST, PUT, PATCH, DELETE, HEAD, OPTIONS. Learn semantics, use cases, and best practices for REST APIs.
CORS Explained: Cross-Origin Resource Sharing Guide
Understand CORS — how cross-origin requests work, preflight checks, headers, common errors, and how to configure CORS correctly for your web application.
Analyzing Server Response Headers: What They Reveal About a Website
A detailed guide to HTTP headers: Cache-Control, ETag, Server, CORS, and security headers. How to read and optimize response headers.

Related Headers

Access-Control-Allow-Credentials
Indicates whether the response to a credentialed cross-origin request can be exposed to JavaScript.
Access-Control-Allow-Headers
Specifies which HTTP headers can be used in the actual request following a CORS preflight.
Access-Control-Allow-Origin
Specifies which origins are permitted to read the response, the fundamental CORS header.
Access-Control-Max-Age
Specifies how long the results of a CORS preflight request can be cached.

Start monitoring for free

Sign up and get access to API, monitoring and notifications

Create Account API Documentation