How to defensively refuse a HTTP “GET” while POST is required?

Question

I understand when POST is required and code has been implemented accordingly. But software penetration test comes back this recommendation:

Only accept POST request f