HTTP Methods Exposure Checker

Ask a server which HTTP methods it advertises, using only OPTIONS and HEAD, and read what the answer means for risk - no state-changing request is ever sent.

Passive public check

a2z.tools reads publicly visible information from the address you enter. It is a read-only request - nothing is submitted, changed or probed.

Address to check Sends a single OPTIONS request and reads the answer. No method is ever tried to see what happens.

Asking, not testing

This tool sends one OPTIONS request and reads the Allow header the server returns. That is a published answer to a standard question - the HTTP specification defines OPTIONS precisely so a client can ask what a resource supports.

It does not try PUT, DELETE, TRACE or anything else to find out what happens. Sending a state-changing method at someone's server to see whether it works is active testing, and on a system you do not own it is the difference between reading a sign and trying the door handle. Every tool in this section is limited to the first.

That limit is worth understanding when reading the result: this reports what the server advertises, which is not always the same as what it accepts. A server can decline to implement OPTIONS and still accept PUT. Confirming that requires authorised testing against your own system.

What the methods mean

TRACE - echoes the request back, including headers the browser attached automatically. This was the basis of Cross-Site Tracing, a technique for reading HttpOnly cookies that ordinary script cannot reach. The original attack no longer works in current browsers, but there is no reason to serve TRACE and every reason to turn it off.
PUT, DELETE, PATCH - expected on an API, and worth a second look on a page or a static path, where they usually indicate a default configuration nobody narrowed. Their presence is not a vulnerability; whether they require authorisation is the actual question, and only you can answer it.
CONNECT - opens a tunnel. On an origin server rather than a proxy this is unexpected, and an open one can be used to relay traffic through your host.
OPTIONS, HEAD, GET - ordinary and expected.

Narrowing the methods

The general fix is to serve only what a path needs. On a static site that is GET and HEAD. On an API it is whatever that endpoint implements, enforced at the routing layer rather than left to the server default.

Note that restricting methods is defence in depth, not access control. A DELETE that requires no authentication is a problem whether or not it is advertised, and blocking the method at the web server is a mitigation rather than a fix. Use OpenAPI Security Auditor to check which operations in an API are genuinely unauthenticated.

Why an empty result is a fine result

Many servers do not implement OPTIONS for ordinary pages and return no Allow header at all. That is not a weakness - it is one less thing published about your configuration. When that happens this tool says so plainly rather than inventing a finding.

Frequently asked questions

Does this send any dangerous requests to my server?

No. It sends one OPTIONS request, which is a read-only question defined by the HTTP specification. It does not send PUT, DELETE, TRACE or any other method, and it does not submit forms or follow paths it was not given.

The server advertises PUT. Is my site vulnerable?

Not necessarily, and this tool deliberately does not find out. Advertising a method says nothing about whether it requires authorisation. Check the routing and authorisation for that path yourself, or through an authorised test of your own system.

Why is TRACE still flagged if the attack no longer works?

Because it has no legitimate use on a production web server and turning it off costs nothing. The severity is medium rather than high precisely because the original Cross-Site Tracing attack is mitigated in modern browsers.

Nothing was returned. Is that bad?

No. It usually means the server does not implement OPTIONS for that path, which is common and perfectly reasonable. There is simply nothing for this check to report.

References

Related tools

What this tool can and cannot tell you. It reports the configuration a site exposes to an ordinary visitor. It does not log in, submit anything, or test for vulnerabilities, so a passing result means the public configuration looked correct at the moment of the check - not that the site is secure.

Security guidance here follows current published sources - OWASP, MDN, the relevant RFCs, NIST, CISA, FIRST and MITRE - which are linked beside the specific claims they support.