Rails only accepts certain http verbs. It is simple enough to tell apache to limit access to passenger
It can also live at the directory or server config level
<VirtualHost *:80>
  ServerName plm.local
  DocumentRoot "/Users/kbrock/projects/plm-website/public"
  RailsEnv development
  <Directory "/Users/kbrock/projects/plm-website/public">
    <LimitExcept POST GET PUT DELETE OPTIONS>
      Order deny,allow
      Deny from all
    </LimitExcept>
  </Directory>
</VirtualHost>

Rails only accepts certain http verbs. It is simple enough to tell apache to limit access to passenger

It can also live at the directory or server config level

<VirtualHost *:80>
  ServerName plm.local
  DocumentRoot "/Users/kbrock/projects/plm-website/public"
  RailsEnv development
  <Directory "/Users/kbrock/projects/plm-website/public">
    <LimitExcept POST GET PUT DELETE OPTIONS>
      Order deny,allow
      Deny from all
    </LimitExcept>
  </Directory>
</VirtualHost>