Every web page loads over HTTP, but the version in use changes how efficiently the browser and server talk. HTTP/1.1 served the web for nearly two decades. HTTP/2 (2015) multiplexed many requests over one connection. HTTP/3 (2022) moved from TCP to QUIC over UDP. Here’s what each changed, and what it means for your site.

At a glance

HTTP/1.1 HTTP/2 HTTP/3
Transport TCP TCP QUIC (UDP)
Encoding Text Binary frames Binary frames
Requests per connection One at a time (in practice) Many in parallel (multiplexing) Many in parallel, independent streams
Header compression None HPACK QPACK
TLS Optional Required in browsers Built into QUIC (TLS 1.3)
Head-of-line blocking Per connection At the TCP level Eliminated between streams
Connection setup TCP + TLS handshakes TCP + TLS handshakes Combined (1 RTT, 0-RTT on resume)
Network change (Wi-Fi → mobile) Reconnect Reconnect Connection migration

HTTP/1.1: one request at a time

A connection carries one request and response at a time. To load 80 assets, browsers open up to ~6 connections per host and queue the rest. Workarounds became common: domain sharding, sprite sheets, concatenating CSS and JS, and inlining resources.

HTTP/2: multiplexing

  • One TCP connection carries many concurrent streams, with no more per-host connection limits or request queues.
  • Binary framing is efficient to parse.
  • HPACK header compression shrinks repetitive headers (cookies, user agents).
  • Stream prioritisation (in theory. In practice, browsers and servers implement it differently).
  • Server push was dropped by browsers. Use preload hints or 103 Early Hints instead.

The HTTP/1.1 workarounds become unnecessary, and sometimes counter-productive (giant bundles defeat caching).

The remaining weakness: TCP delivers bytes strictly in order. If one packet is lost, all streams on that connection wait for the retransmission. That’s TCP-level head-of-line blocking, which hurts on lossy mobile networks.

HTTP/3: HTTP over QUIC

QUIC is a transport protocol on top of UDP, with TLS 1.3 built in:

  • Independent streams: a lost packet only delays its own stream.
  • Faster setup: the transport and cryptographic handshakes are combined, in one round trip, and 0-RTT resumption for returning visitors.
  • Connection migration: a connection survives IP changes (switching from Wi-Fi to 4G) using connection IDs.
  • Runs in user space, so improvements ship with browsers and servers rather than OS kernels.

Benefits are largest for high-latency or lossy connections (mobile users, distant visitors). On fast, clean wired links, the difference from HTTP/2 is small. See QUIC protocol and latency vs bandwidth.

Browsers discover HTTP/3 through the Alt-Svc header (or HTTPS DNS records), and use it on subsequent connections if UDP 443 works. They fall back to HTTP/2 automatically when UDP is blocked.

What to enable on your server

  1. HTTPS everywhere. HTTP/2 and HTTP/3 need TLS in browsers. See Let’s Encrypt for Nginx.
  2. HTTP/2: supported by every modern web server, and a one-line change:
listen 443 ssl;
http2 on;          # Nginx 1.25.1+; older versions: listen 443 ssl http2;
  1. HTTP/3: Nginx 1.25+ (built with QUIC support), Caddy (on by default), LiteSpeed and OpenLiteSpeed, HAProxy 2.6+, or a CDN that terminates HTTP/3 for you. Open UDP 443 in the firewall. See HTTP/2 and HTTP/3 in Nginx and Caddy.

Behind Cloudflare or another CDN, visitors get HTTP/2 or HTTP/3 to the edge regardless. The CDN talks to your origin separately, usually over HTTP/1.1 or HTTP/2.

Check which version is used

curl -sI --http2 https://example.com -o /dev/null -w '%{http_version}\n'     # 2
curl -sI --http3 https://example.com -o /dev/null -w '%{http_version}\n'     # 3 (curl built with HTTP/3)
curl -sI https://example.com | grep -i alt-svc                             # advertises h3

In the browser: open DevTools → Network, and add the Protocol column (h2, h3).

Practical performance tips per version

  • With HTTP/2 and HTTP/3, don’t shard domains, and don’t over-bundle. Moderate bundles with good caching work best.
  • Reduce round trips: TLS 1.3, OCSP stapling, preconnect to critical third-party origins, and early hints. See TLS configuration.
  • Fewer third-party origins means fewer connections to set up.
  • Compression (Brotli or gzip) and caching matter as much as the protocol. See Nginx gzip and Brotli and website speed optimization.

Quick reference

Feature 1.1 2 3
Multiplexing ✗ ✓ ✓
Header compression ✗ HPACK QPACK
HOL blocking Yes At TCP level No (between streams)
Transport TCP TCP UDP (QUIC)
Firewall needs TCP 80/443 TCP 443 UDP 443 + TCP 443 fallback

Related: HTTP status codes and Core Web Vitals.

  • HTTP
  • Web Performance
  • Networking