HTTP/2 or HTTP/3 enabled on server and CDN
Why it matters
HTTP/1.1 limits browsers to 6 parallel TCP connections per origin. A page loading 30 assets — JS chunks, CSS, images, fonts — from a single origin serializes those requests into 5 batches, each waiting for the previous to finish (ISO-25010 time-behaviour). HTTP/2 multiplexes all requests over a single connection with no per-connection limit, eliminating the batching delay entirely. HTTP/3 adds QUIC transport, removing the head-of-line blocking that HTTP/2 still has at the TCP layer. Remaining on HTTP/1.1 in 2025 is a structural performance penalty.
Severity rationale
Low because HTTP/1.1 adds measurable latency on asset-heavy pages but most modern hosting platforms default to HTTP/2, so the finding typically reflects a misconfiguration rather than a missing feature.
Remediation
Verify your protocol and enable HTTP/2 or HTTP/3 where it is not already active. Check the response protocol:
curl -sI https://yoursite.com | head -5
# Expected: HTTP/2 or HTTP/3 in the first line
For common hosting platforms — no code change required, just verify settings:
- Vercel: HTTP/2 and HTTP/3 enabled by default on all deployments.
- Netlify: HTTP/2 enabled by default.
- AWS CloudFront: Enable HTTP/2 in the distribution's Protocol Policy settings (CloudFront → Distribution → Edit → HTTP/2).
- Cloudflare: HTTP/2 and HTTP/3 enabled by default in Speed → Optimization.
For custom Nginx servers, ensure listen 443 ssl http2; is in the server block. For Node.js servers without a reverse proxy, use the built-in http2 module or place Caddy or Nginx in front.
DetectionPro
The detection method for this pattern is part of AuditBuffet Pro.
The full method (what to look for, pass and fail conditions, and how results get reported) ships inside the Performance Core Audit. The pattern definition, severity rationale, and remediation remain openly licensed under CC-BY-4.0.
External references
- iso-25010:2011 · performance-efficiency.time-behaviour — Time Behaviour
Taxons
History
- 2026-04-18·v1.0.0·Initial import from performance-core·automated