# Block TRACE, TRACK and Other Unusual HTTP Methods

> Answers requests that use HTTP methods WordPress never needs (such as TRACE, TRACK, CONNECT or DEBUG) with a 405 error before any page is built.

- Type: PHP
- Runs: Run everywhere
- Category: [Security](https://wpide.com/library/category/security/)
- Tags: http, hardening, requests
- Author: WPIDE Team
- Installs: 0
- Updated: 2026-10-28
- Page: https://wpide.com/library/sec-block-unusual-http-methods/

## Code

```php
// Methods that are allowed.
$wpide_allowed_methods = array( 'GET', 'POST', 'HEAD', 'OPTIONS', 'PUT', 'PATCH', 'DELETE' );

add_action( 'init', function () use ( $wpide_allowed_methods ) {
    if ( ( defined( 'WP_CLI' ) && WP_CLI ) || empty( $_SERVER['REQUEST_METHOD'] ) ) {
        return;
    }

    $method = strtoupper( sanitize_key( $_SERVER['REQUEST_METHOD'] ) );

    if ( ! in_array( $method, $wpide_allowed_methods, true ) ) {
        status_header( 405 );
        header( 'Allow: ' . implode( ', ', $wpide_allowed_methods ) );
        exit;
    }
}, 0 );
```

## Notes

GET, POST, HEAD, OPTIONS, PUT, PATCH and DELETE stay allowed because the REST API uses them.

## How to use it

Install the free WPIDE plugin (https://wordpress.org/plugins/wpide/), find "Block TRACE, TRACK and Other Unusual HTTP Methods" in its snippet library and add it in one click; or create a new PHP snippet in WPIDE (or any code snippets plugin) and paste the code above. More snippets: https://wpide.com/library/