Online Tool Store
HTTP Methods Auditor
Audit which HTTP methods (GET, POST, PUT, DELETE, TRACE, and more) an API endpoint allows, with security notes for each, example result shown.
🔒 This tool runs entirely in your browser. Your files are never uploaded to a server.
Example shown - auditing an arbitrary endpoint's allowed HTTP methods requires a cross-origin request, which browsers block for security (CORS). This preview doesn't connect to other domains.
| Method | Status | Notes |
|---|
How the HTTP methods auditor works
- Enter an API endpoint URL and click Audit methods.
- Review which HTTP methods (GET, POST, PUT, DELETE, and more) are allowed.
- Check the notes for security-relevant guidance on each method.
FAQ
Why can't this tool check any endpoint I enter?
Determining which HTTP methods a server allows requires sending real requests (including an OPTIONS preflight) to that server from your browser, which is blocked for cross-origin requests by CORS unless the target explicitly allows it.
Why does TRACE being blocked matter?
The TRACE method can be used in cross-site tracing attacks to read HTTP headers (including cookies) that JavaScript normally can't access - disabling it is a common security best practice.
How can I audit my own server's allowed methods?
Use a command-line tool like curl with the -X OPTIONS flag, or check your server's configuration directly, since same-origin or server-side tools aren't restricted by browser CORS rules.
Why does OPTIONS matter for an API?
Browsers automatically send an OPTIONS preflight request before certain cross-origin requests to check what methods and headers are allowed - if OPTIONS isn't handled correctly, legitimate cross-origin API calls can fail.
How we compare
| Feature | Online Tool Store | curl -X OPTIONS | API security scanner |
|---|---|---|---|
| Clear method-by-method breakdown | ✓ | ✗ | ✓ |
| No install required | ✓ | ✗ | ✗ |
| Real cross-origin scanning | ✗ | ✓ | ✓ |
For a real audit of your own API's allowed methods, use curl or a server-side security scanning tool.