All Products
Search

This Product

    :Troubleshoot 405 errors

    Document Center

    :Troubleshoot 405 errors

    Last Updated:Jun 05, 2026

    Problem description

    After you deploy Web Application Firewall (WAF) for your website, WAF returns an HTTP 405 error and displays a block page when it detects requests that may pose security threats to the website.

    Solutions

    WAF 3.0

    1. Obtain the request ID: After a request is blocked, the request ID is displayed by default on the blocking page. Copy this ID for subsequent search. image

    2. Search in the WAF console: Log on to the WAF 3.0 console. In the left-side navigation pane, choose Detection and Response > Security Reports. Set a time range for the search, and paste the request ID in the Enter Trace ID search box.

      Note

      If log delivery is enabled for the protection object, you can also search on the Detection and Response > Log Service page.

    3. Analyze the blocking reason: On the Security Reports page, view the Protection Module and Rules Matched matched by the request at the bottom of the page. If you confirm that the request is normal business traffic, click Suppress False Positive in the Actions column of Logs to add the request to a whitelist. For more information, see Whitelist.

    WAF 2.0

    1. Obtain the request ID: When a request is blocked, the block page displays the request ID by default. Copy this ID for later lookup.

    2. Query in the WAF console: Log on to the Web Application Firewall console.

      • If Log Service is enabled for the domain: In the left-side navigation pane, choose Security Operations > Log Service. On the Log Search tab, paste the request ID and specify a time range to search.

      • If Log Service is not enabled: In the left-side navigation pane, choose Security Operations > Security Report. Filter by time range, IP address, or attack URL.

    3. Analyze the block reason: If the blocked request is confirmed to be legitimate business traffic, take the following actions based on the rule type:

      • System built-in protection rule false positive
        If the request is blocked by a system built-in rule of the Protection Rules Engine, go to Security Report > Web Intrusion Prevention > Ignore False Positives to disable the specific rule that triggered the false positive.

      • Custom protection rule false positive
        If the request is blocked by a custom protection rule, modify the corresponding rule. Alternatively, on the Website Protection page, create a whitelist rule with specific match conditions to disable designated protection modules or rules when conditions are met. For more information, see Configure a website whitelist.