A usual Website just needs 3 HTTP Methods: GET, HEAD and POST. Block all other Methods by using limit_except:
GET
HEAD
POST
location / { [...] # Note: GET includes HEAD limit_except GET POST { deny all; } [...] }