> ## Documentation Index
> Fetch the complete documentation index at: https://docs.37audits.com/llms.txt
> Use this file to discover all available pages before exploring further.

# HTTP Version Auditor

> Checks that your site speaks HTTP/2 and advertises HTTP/3

<Info>
  **Performance Auditor**: checks which HTTP versions your server negotiates and whether it advertises HTTP/3 to browsers.
</Info>

<CardGroup cols={2}>
  <Card title="Parallel loading" icon="layer-group">
    HTTP/2 and HTTP/3 load all of a page's files over one connection at the same time.
  </Card>

  <Card title="Mobile networks" icon="mobile">
    HTTP/3 runs on QUIC, which keeps pages loading when a mobile or Wi-Fi connection drops packets.
  </Card>
</CardGroup>

A page needs dozens of files: HTML, styles, scripts, fonts and images. HTTP/1.1 fetches them a few at a time, HTTP/2 fetches them all at once over one connection, and HTTP/3 does the same over QUIC, so one lost packet no longer stalls every file. Browsers use HTTP/2 when the server offers it during the TLS handshake, and switch to HTTP/3 only after the server advertises it in an `Alt-Svc` header. This auditor checks both.

## How it works

1. **HTTP/1.1 request**: sends a `GET` to the audited URL over HTTP/1.1 as 37AuditsBot and keeps only the headers. A blocked request ends the audit with `590`. A timeout, DNS or TLS failure, or a status other than 2xx ends it with `500`.
2. **HTTP/2 request**: sends the same `GET` offering HTTP/2 and records the version the server negotiated (`HTTP/2` or `HTTP/1.1`).
3. **Alt-Svc**: reads the `Alt-Svc` headers of both answers and looks for an `h3` token (`h3`, or a draft such as `h3-29`).
4. **Rules**: HTTP/1.1 without an HTTP/3 advertisement fails (`400`). HTTP/2 without an HTTP/3 advertisement warns (`300`).
5. **Aggregate**: `FAIL` wins over `WARNING`. An HTTP/3 advertisement is `SUCCESS` (`200`).

## What it audits

Every row maps to one `checkRule*` method and one `CheckCode`, in the order the auditor runs them. CheckCode suffixes use status ranges: `200` success, `300–399` warning, `400–499` fail, `500–599` error.

| CheckCode | Status | When it fires | Recommendation | Why it matters |
| - | - | - | - | - |
| <a id="37A-HTTPVersionAuditor-400" />`37A-HTTPVersionAuditor-400` | `FAIL` | The server answers the HTTP/2 offer with HTTP/1.1 and advertises no HTTP/3 in `Alt-Svc`. | Enable HTTP/2 on `{server}` (or the CDN in front of it) for `{host}`, then advertise HTTP/3 with an Alt-Svc: h3=":443" header. | HTTP/1.1 loads a page's files a few at a time, so every page takes longer to appear, most of all on mobile networks. Slower pages lose visitors and rank lower in search. |
| <a id="37A-HTTPVersionAuditor-300" />`37A-HTTPVersionAuditor-300` | `WARNING` | The server negotiates HTTP/2 but advertises no HTTP/3 in `Alt-Svc`. | Turn on HTTP/3 (QUIC) on `{server}` or your CDN for `{host}`, and send Alt-Svc: h3=":443"; ma=86400 so browsers can upgrade. | HTTP/3 keeps pages fast on unreliable mobile and Wi-Fi connections, where HTTP/2 stalls after a lost packet. Without it, visitors on poor networks wait longer for every page. |
| <a id="37A-HTTPVersionAuditor-200" />`37A-HTTPVersionAuditor-200` | `SUCCESS` | All rules passed. Message is `{url} advertises HTTP/3 ({h3Token} in Alt-Svc) and negotiated {version}.` | — | — |
| <a id="37A-HTTPVersionAuditor-500" />`37A-HTTPVersionAuditor-500` | `ERROR` | The audited page could not be fetched: timeout, DNS or TLS failure, or a status other than 2xx (HTTP 404, HTTP 5xx). | Make sure `{url}` answers with HTTP 2xx, then run the audit again. Last error: `{error}`. | — |
| <a id="37A-HTTPVersionAuditor-590" />`37A-HTTPVersionAuditor-590` | `ERROR` | The audited page answered HTTP 403, HTTP 429 or a Cloudflare challenge, so 37AuditsBot was blocked before it could read the page. | Allow 37AuditsBot in your firewall or bot protection: allowlist its user agent, or verify its Web Bot Auth signature. See [https://www.37audits.com/bot](https://www.37audits.com/bot). | While 37AuditsBot is blocked this audit cannot look at the site, so problems on it go unreported. |

## Output documentation

| Status | Description | Test logic |
| - | - | - |
| **SUCCESS** | The site advertises HTTP/3 | An `h3` token in `Alt-Svc` (`200`). |
| **WARNING** | HTTP/2 works, HTTP/3 is not advertised | HTTP/2 negotiated, no `h3` token (`300`). |
| **FAIL** | The site only speaks HTTP/1.x | HTTP/1.1 negotiated, no `h3` token (`400`). |
| **ERROR** | The auditor could not fetch the page | Timeout, DNS or TLS failure, or a status other than 2xx (`500`); site blocked 37AuditsBot (`590`). |

## Risks and considerations

### Why the HTTP version matters

* HTTP/1.1 opens a handful of connections and queues every other file behind them. On a page with many assets this adds round trips, and the delay grows with network latency.
* HTTP/2 sends every file over one connection at once, but runs on TCP: one lost packet holds up every file until it is resent.
* HTTP/3 runs on QUIC (UDP), so a lost packet delays only the file it belongs to, and the connection survives switching between Wi-Fi and mobile data.

### Turning them on

* Most CDNs (Cloudflare, Fastly, CloudFront, Akamai) offer HTTP/2 and HTTP/3 as a setting. Behind a CDN, the CDN's edge is what this auditor sees.
* On your own server, HTTP/2 needs TLS with ALPN (nginx `http2 on;`, Apache `mod_http2`). HTTP/3 needs UDP port 443 open and a server built with QUIC support, plus the `Alt-Svc` header.

### What this auditor does not check

* HTTP/3 is detected from the `Alt-Svc` advertisement only: the auditor does not open a QUIC connection, so it cannot tell whether UDP 443 is reachable.
* A draft token such as `h3-29` counts as an advertisement, although current browsers only use `h3`.
* Plain `http://` URLs cannot negotiate HTTP/2 the way browsers do (browsers use HTTP/2 only over TLS), so audit the `https://` address.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.