HTTP/2 or HTTP/3 enabled on server and CDN

HTTP/1.1 limits browsers to 6 parallel TCP connections per origin. A page loading 30 assets — JS chunks, CSS, images, fonts — from a single origin serializes those requests into 5 batches, each waiting for the previous to finish (ISO-25010 time-behaviour). HTTP/2 multiplexes all requests over a single connection with no per-connection limit, eliminating the batching delay entirely. HTTP/3 adds QUIC transport, removing the head-of-line blocking that HTTP/2 still has at the TCP layer. Remaining on HTTP/1.1 in 2025 is a structural performance penalty.

Verify your protocol and enable HTTP/2 or HTTP/3 where it is not already active. Check the response protocol:

curl -sI https://yoursite.com | head -5
# Expected: HTTP/2 or HTTP/3 in the first line

For common hosting platforms — no code change required, just verify settings:

• Vercel: HTTP/2 and HTTP/3 enabled by default on all deployments.
• Netlify: HTTP/2 enabled by default.
• AWS CloudFront: Enable HTTP/2 in the distribution's Protocol Policy settings (CloudFront → Distribution → Edit → HTTP/2).
• Cloudflare: HTTP/2 and HTTP/3 enabled by default in Speed → Optimization.

For custom Nginx servers, ensure listen 443 ssl http2; is in the server block. For Node.js servers without a reverse proxy, use the built-in http2 module or place Caddy or Nginx in front.

• ID: http2-enabled

• Severity: low

• What to look for: Count all relevant instances and enumerate each. Check hosting platform documentation or headers. For Vercel, Netlify, AWS, look for HTTP/2 or HTTP/3 enabled by default. Inspect response headers: HTTP/2.0 or HTTP/3 in server response. Check CDN provider (Cloudflare, AWS CloudFront, etc.) for HTTP/2+ settings.

• Pass criteria: Server responds over HTTP/2 or HTTP/3. At least 1 implementation must be verified. Connection multiplexing is enabled. CDN (if used) also supports HTTP/2+.

• Fail criteria: Server responds over HTTP/1.1, forcing browsers to open multiple connections for parallel requests. Modern hosting platforms should default to HTTP/2.

• Skip (N/A) when: The project is not deployed or uses an old hosting platform without HTTP/2 support.

• Detail on fail: Specify the protocol. Example: "Server responds over HTTP/1.1; DevTools shows 6 TCP connections for parallel requests. Upgrade to HTTP/2 for connection multiplexing" or "CDN supports HTTP/2 but origin server is HTTP/1.1; requests to origin are slow".

• Remediation: Modern hosting platforms include HTTP/2 by default. Verify in your platform settings:

  Vercel: HTTP/2 enabled by default. Netlify: HTTP/2 enabled by default. AWS CloudFront: Enable HTTP/2 in distribution settings. Cloudflare: HTTP/2 and HTTP/3 enabled by default.

  Check response headers:

  curl -I https://yoursite.com
  # Look for: HTTP/2.0 or HTTP/3