diff -r fddcb51b5084 -r fc5e261915b9 mercurial/wireprotoserver.py
--- a/mercurial/wireprotoserver.py	Mon Mar 19 16:43:47 2018 -0700
+++ b/mercurial/wireprotoserver.py	Tue Mar 13 11:57:43 2018 -0700
@@ -299,6 +299,12 @@
         res.setbodybytes(_('unknown permission: %s') % permission)
         return
 
+    if req.method != 'POST':
+        res.status = b'405 Method Not Allowed'
+        res.headers[b'Allow'] = b'POST'
+        res.setbodybytes(_('commands require POST requests'))
+        return
+
     # At some point we'll want to use our own API instead of recycling the
     # behavior of version 1 of the wire protocol...
     # TODO return reasonable responses - not responses that overload the