Skip to main content
Performance Auditor: checks which HTTP versions your server negotiates and whether it advertises HTTP/3 to browsers.

Parallel loading

HTTP/2 and HTTP/3 load all of a page’s files over one connection at the same time.

Mobile networks

HTTP/3 runs on QUIC, which keeps pages loading when a mobile or Wi-Fi connection drops packets.
A page needs dozens of files: HTML, styles, scripts, fonts and images. HTTP/1.1 fetches them a few at a time, HTTP/2 fetches them all at once over one connection, and HTTP/3 does the same over QUIC, so one lost packet no longer stalls every file. Browsers use HTTP/2 when the server offers it during the TLS handshake, and switch to HTTP/3 only after the server advertises it in an Alt-Svc header. This auditor checks both.

​
How it works

  1. HTTP/1.1 request: sends a GET to the audited URL over HTTP/1.1 as 37AuditsBot and keeps only the headers. A blocked request ends the audit with 590. A timeout, DNS or TLS failure, or a status other than 2xx ends it with 500.
  2. HTTP/2 request: sends the same GET offering HTTP/2 and records the version the server negotiated (HTTP/2 or HTTP/1.1).
  3. Alt-Svc: reads the Alt-Svc headers of both answers and looks for an h3 token (h3, or a draft such as h3-29).
  4. Rules: HTTP/1.1 without an HTTP/3 advertisement fails (400). HTTP/2 without an HTTP/3 advertisement warns (300).
  5. Aggregate: FAIL wins over WARNING. An HTTP/3 advertisement is SUCCESS (200).

​
What it audits

Every row maps to one checkRule* method and one CheckCode, in the order the auditor runs them. CheckCode suffixes use status ranges: 200 success, 300–399 warning, 400–499 fail, 500–599 error.

​
Output documentation

​
Risks and considerations

​
Why the HTTP version matters

  • HTTP/1.1 opens a handful of connections and queues every other file behind them. On a page with many assets this adds round trips, and the delay grows with network latency.
  • HTTP/2 sends every file over one connection at once, but runs on TCP: one lost packet holds up every file until it is resent.
  • HTTP/3 runs on QUIC (UDP), so a lost packet delays only the file it belongs to, and the connection survives switching between Wi-Fi and mobile data.

​
Turning them on

  • Most CDNs (Cloudflare, Fastly, CloudFront, Akamai) offer HTTP/2 and HTTP/3 as a setting. Behind a CDN, the CDN’s edge is what this auditor sees.
  • On your own server, HTTP/2 needs TLS with ALPN (nginx http2 on;, Apache mod_http2). HTTP/3 needs UDP port 443 open and a server built with QUIC support, plus the Alt-Svc header.

​
What this auditor does not check

  • HTTP/3 is detected from the Alt-Svc advertisement only: the auditor does not open a QUIC connection, so it cannot tell whether UDP 443 is reachable.
  • A draft token such as h3-29 counts as an advertisement, although current browsers only use h3.
  • Plain http:// URLs cannot negotiate HTTP/2 the way browsers do (browsers use HTTP/2 only over TLS), so audit the https:// address.