v0.25.3

docs/VHOST_ACCESS.md

@@ -89,6 +89,12 @@ blocking that address for the rest of the window. Busy hashing returns 503; a
 blocked address returns 429 with Retry-After. This is abuse resistance, not MFA or
 a replacement for perimeter rate limiting, especially for many clients behind NAT.
 
+## HTTP method policy
+
+Each vhost can leave method filtering **Off**, define an **Allow only** list, or define a **Block** list. Methods are validated as HTTP method tokens and normalized to uppercase. A denied request returns `405 Method Not Allowed` before authentication, cache, DNS or origin connection; allow-list mode also returns an `Allow` header containing the configured methods.
+
+A Custom location has the same independent method policy. Vhost and location policies are cumulative: a location cannot re-enable a method rejected by its vhost. This makes patterns such as `GET, HEAD, POST` allow-only at host level and a stricter `GET, HEAD` allow-only policy on a read-only location explicit and fail-closed.
+
 ## Custom locations
 
 The **Custom locations** tab supports ordinary prefix, priority prefix (`^~`), exact (`=`),
@@ -97,7 +103,9 @@ a selected priority prefix skips regex evaluation; regexes are tested in declara
 longest ordinary prefix is the fallback. Exact paths preserve a meaningful trailing slash.
 
 A proxy location can use the normal pool, pin one backend, inherit/override cache behavior and
-apply an additional ACL. Path handling can preserve the public URL, strip a prefix, replace a
+apply an additional inline ACL. It can also select a reusable ACL profile, apply its own country
+allow/block policy and define an HTTP method allow/block policy. These controls are cumulative with
+the vhost policies and are enforced before a backend connection is opened. Path handling can preserve the public URL, strip a prefix, replace a
 prefix or perform a capture-based regex rewrite. Query parameters are preserved. Repeated literal
 slashes are normalized only for routing/ACL decisions; without an explicit rewrite the backend
 receives the original target, including `//`. Encoded separators, percent double-decoding and dot