HTTP methods beyond GET and POST — PUT, DELETE, TRACE, and others — are often left enabled on a server by default even when your application never actually uses them, giving an attacker extra ways to probe or manipulate your site that you never intended to expose.
Most sites only need GET and POST. Leaving TRACE, PUT, or DELETE enabled expands your attack surface for no functional benefit — TRACE specifically enables Cross-Site Tracing, a real cookie-theft technique.
Unnecessary HTTP methods like TRACE, PUT, and DELETE, when left enabled without genuine functional need, expand your site's attack surface by providing additional interaction capabilities beyond the standard GET and POST methods most web applications actually require for their legitimate functionality.
The TRACE method specifically carries genuine, documented risk through a historical attack technique that could potentially be used to bypass certain security protections and access sensitive header information, including cookies marked with the HttpOnly flag specifically meant to prevent this kind of access — making TRACE particularly worth explicitly disabling unless you have a genuine, specific need for it.
PUT and DELETE methods, if enabled without proper authentication and authorization controls specifically governing their use, could potentially allow unauthorized modification or deletion of server resources — even if your application doesn't actively use these methods for its intended functionality, their availability at the server level represents unnecessary risk if not genuinely required.
The general security principle here mirrors other checks throughout this broader hardening work — disabling functionality you don't actually, genuinely need reduces available attack surface, and explicitly restricting HTTP methods to only those your application genuinely requires for its actual functionality closes off this specific category of unnecessary exposure.
Your server only accepts the HTTP methods your application actually uses.
Fix it, then re-scan — the check confirms itself. No manual checkbox, the scan is the truth.
Run this check in H.I.V.E. →