What is HTTP/3?
HTTP/3 (RFC 9114) is the third major version of HTTP. Instead of TCP it runs over QUIC (RFC 9000), a transport protocol on UDP with TLS 1.3 built in. Connection setup and encryption happen in one step, a lost packet no longer stalls all parallel requests, and a connection survives switching from Wi-Fi to mobile data.
All major browsers speak HTTP/3, as do CDNs like Cloudflare and web servers like Caddy, LiteSpeed and nginx from version 1.25. Visitors on mobile networks with fluctuating connections notice the difference most.
How HTTP/3 is advertised
A browser does not know in advance whether a server speaks QUIC. So the first connection usually uses HTTP/2, and the server announces in the Alt-Svc header that the same service is also available over HTTP/3: h3 stands for HTTP/3, the number after the colon is the UDP port, ma is how many seconds the browser remembers it. From the next connection on it tries QUIC.
HTTP/2 200
content-type: text/html; charset=utf-8
alt-svc: h3=":443"; ma=86400Why broken HTTP/3 matters
The typical case: the web server advertises HTTP/3, but UDP port 443 is closed. After a server move, a new firewall rule, or at a host that only opens TCP 443. The Alt-Svc header stays, because it comes from the web server configuration.
Browsers then try QUIC, wait for an answer and fall back to HTTP/2. The site loads, but noticeably slower, and monitoring over TCP stays green. This is exactly the state the check finds: advertised, but not reachable over QUIC.
What the check tests
- The domain and www. If you enter a subdomain such as shop.example.com, only that host.
- Alt-Svc of the final response after all redirects, with the advertised port.
- A second request over HTTP/3 only to exactly that origin, without falling back to TCP.
- Advertised but no answer over QUIC: warning. Before that the check tests its own QUIC path against reference targets, so a problem at the checking location does not raise a false alarm.
- No h3 in the Alt-Svc header: hint. HTTP/3 is optional; in the domain check it costs no points.
Setting up HTTP/3
Two things have to match: the web server listens for QUIC, and UDP 443 is open all the way.
- Web server: in nginx 1.25+ an additional listen line with quic plus the Alt-Svc header; Caddy and LiteSpeed have HTTP/3 enabled by default.
- Firewall: open UDP 443 inbound, on the server and in any firewall your host puts in front. Rules for TCP 443 do not apply to UDP.
- Load balancers and reverse proxies: many only forward TCP. Terminate QUIC there or remove the Alt-Svc header.
- If UDP cannot be opened, remove the Alt-Svc header. Without the announcement no browser tries HTTP/3, and there is no delay.
server {
listen 443 ssl;
listen 443 quic reuseport;
http2 on;
server_name example.com www.example.com;
add_header Alt-Svc 'h3=":443"; ma=86400' always;
}Monitoring HTTP/3 continuously
A blocked UDP port rarely shows up when you check yourself, because the browser quietly falls back to HTTP/2. DomainWarn checks the websites of all client domains for HTTP/3, every 6 hours on Free and hourly otherwise. If advertised HTTP/3 does not answer over QUIC twice in a row, an incident opens, and a change of the announcement appears in the timeline.
Frequently asked questions
- Does my website need HTTP/3?
- No. HTTP/2 is fast and supported by every browser. HTTP/3 mostly helps on mobile networks. Only an announcement with nothing behind it is a problem: it is worse than none.
- My browser shows HTTP/3, but the check reports it as unreachable?
- Your connection may have gone through a CDN or another location, or the browser reused a remembered connection. With curl --http3-only -I https://example.com/ you test over QUIC specifically, from a machine outside your network.
- Why does the check say "not checked"?
- To fetch over QUIC, the checking location needs a working UDP path itself. Without it the check only shows what the Alt-Svc header advertises and says explicitly that reachability was not checked. That is not a finding about your website.