HTTP request methods in plain words
GET, POST, PUT, PATCH, DELETE, HEAD, OPTIONS and TRACE: what each one is for.
From the archive: first published on mohamedsharaf.net in August 2012. Rewritten and checked in 2026; some details may be out of date.
Every HTTP request starts with a method that says what the client wants to do. The ones you will meet:
- GET: read something. It should never change data, so browsers, caches and crawlers can repeat it freely.
- POST: send data to be processed, such as a form or a new record. Not safe to repeat blindly; that’s why browsers warn before resubmitting.
- PUT: create or fully replace a resource at a known address. Repeating it gives the same result.
- PATCH: change part of a resource.
- DELETE: remove a resource.
- HEAD: like GET, but returns only the headers. Handy to check whether a file exists or has changed.
- OPTIONS: ask what the server allows. Browsers send it before some cross-site requests (CORS “preflight”).
- TRACE: echoes the request back, for debugging. Keep it disabled on production servers; it has been abused in attacks.
The security lesson hiding in this list: an action that changes data must never be triggered by a GET request. Otherwise a single link or image tag on another site can trigger it.