Your files stay on your device

HTTP methods exposure checker

Send one OPTIONS request to a host and rate which HTTP methods it advertises, never trying anything state changing.

A passive public check
Nothing leaves this page until you do, and what leaves is one OPTIONS request, the read-only verb that asks a server to describe itself. No method is ever tried to see what happens.

Findings grade the advertisement, not behavior: an Allow header listing PUT says the server claims to know PUT, and confirming whether it enforces authentication on that route needs your own review, because this tool will never send one. A 405 to OPTIONS is often deliberate hardening, not a fault. The wildcard Allow that some servers send is reserved in RFC 9110 and means nothing to conforming clients. Results describe what one OPTIONS answer said at check time; routes differ per path, so an API route and the homepage can legitimately advertise different lists.
Options

Was this tool useful?
YesNo

Canonical HTML: https://nutter.tools/network/http-methods-exposure-checker
Markdown version: https://nutter.tools/network/http-methods-exposure-checker.md
Plain-text version: https://nutter.tools/network/http-methods-exposure-checker.txt
Agent index: https://nutter.tools/llms.txt