HTTP/2 is the second major version of the HTTP protocol, standardized as RFC 7540 in May 2015. It replaces HTTP/1.1's text-based, one-request-per-connection design with a binary, multiplexed protocol that can send and receive many requests in parallel over a single TCP connection. HTTP/3 (RFC 9114, June 2022) goes further by replacing TCP with QUIC over UDP for even lower latency.
Every browser implementation of HTTP/2 and HTTP/3 requires TLS — see why your website must use HTTPS. If your site is on plain HTTP, you cannot use HTTP/2 at all.
103 Early Hints instead.h2 or h3.| Feature | HTTP/1.1 | HTTP/2 | HTTP/3 |
|---|---|---|---|
| RFC | 2616 / 7230 (1999/2014) | 7540 / 9113 (2015/2022) | 9114 (2022) |
| Format | Text | Binary frames | Binary frames |
| Transport | TCP | TCP + TLS | QUIC (UDP) + TLS 1.3 |
| Multiplexing | No (1 request per connection) | Yes | Yes |
| Header compression | None | HPACK | QPACK |
| Head-of-line blocking | Yes | At TCP layer only | Eliminated |
| Server Push | No | Yes (deprecated 2022) | Yes (rarely used) |
| 0-RTT resumption | No | No | Yes |
| Connection migration | No | No | Yes (survives IP change) |
On a typical page with 50+ subresources, HTTP/1.1 either opens 6 parallel TCP connections (the browser limit) or pipelines requests serially. HTTP/2 sends all 50 requests over a single connection, interleaved as binary frames, with no per-request handshake cost. The result is most visible on:
Because HTTP/2 can send requests in parallel, common HTTP/1.1 workarounds (sprite sheets, JS bundling, domain sharding, inlining) are now anti-patterns. They hurt cacheability without helping performance.
The fastest path. Most CDNs and edge runtimes enable HTTP/2 and HTTP/3 by default once HTTPS is configured. Nothing to install.
# Nginx 1.25+ — HTTP/2 and HTTP/3
server {
listen 443 ssl;
listen [::]:443 ssl;
http2 on;
http3 on; # requires Nginx 1.25+ built with QUIC
listen 443 quic reuseport;
server_name example.com;
ssl_certificate /etc/letsencrypt/live/example.com/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/example.com/privkey.pem;
# Advertise HTTP/3 to clients on HTTP/2
add_header Alt-Svc 'h3=":443"; ma=86400' always;
}# Apache 2.4.17+
LoadModule http2_module modules/mod_http2.so
Protocols h2 http/1.1import { createSecureServer } from 'node:http2';
import { readFileSync } from 'node:fs';
const server = createSecureServer({
key: readFileSync('privkey.pem'),
cert: readFileSync('fullchain.pem'),
allowHTTP1: true, // backwards-compatible with HTTP/1.1 clients
});
server.on('stream', (stream) => {
stream.respond({ ':status': 200, 'content-type': 'text/html' });
stream.end('<h1>HTTP/2 from Node</h1>');
});
server.listen(443);h2 (HTTP/2), h3 (HTTP/3), or http/1.1.From the command line:
# Confirm HTTP/2
curl -I --http2 https://example.com -o /dev/null -s -w "%{http_version}\n"
# Output: 2
# Confirm HTTP/3 (requires curl built with HTTP/3 support)
curl -I --http3 https://example.com -o /dev/null -s -w "%{http_version}\n"
# Output: 3Domain sharding, image spriting, and aggressive bundling were workarounds for HTTP/1.1's 6-connection limit. Under HTTP/2 they hurt cache hit rates without helping speed.
<!-- Bad under HTTP/2 — sharding splits the connection pool -->
<img src="https://img1.example.com/a.jpg">
<img src="https://img2.example.com/b.jpg">
<!-- Good — single origin lets HTTP/2 multiplex -->
<img src="https://example.com/a.jpg">
<img src="https://example.com/b.jpg">Chrome removed HTTP/2 Server Push in v106 (October 2022). Replace it with 103 Early Hints or standard preload links.
# Better than Server Push
HTTP/1.1 103 Early Hints
Link: </styles/main.css>; rel=preload; as=style
Link: </app.js>; rel=preload; as=scriptBrowsers only negotiate HTTP/2 over TLS. No HTTPS, no HTTP/2.
If your CDN supports it, enable HTTP/3 with one click. Mobile users on flaky networks see the biggest wins because QUIC survives IP changes (Wi-Fi to cellular).
--http2 / --http3 — quick command-line verification of negotiated protocol.Yes, in browsers. The spec allows h2c (cleartext HTTP/2) but no major browser implements it. See why HTTPS is required.
Bundle moderately. HTTP/2 removes the per-request cost penalty, but compression ratios are still better on slightly larger files. Aim for chunks of 30-100 KB.
Yes. Chrome, Firefox, Safari, and Edge all support HTTP/3, and major CDNs serve it by default. As of 2026 over 30% of websites in HTTP Archive support HTTP/3.
No. Servers fall back to HTTP/1.1 via ALPN negotiation when the client does not support HTTP/2.
It was hard to use correctly: servers pushed resources the client already had cached, wasting bandwidth. Chrome (v106, October 2022) removed it. Use 103 Early Hints instead.
Indirectly, yes. Faster pages improve Core Web Vitals, which is a ranking factor. HTTP/2 itself is not a separate ranking signal.
Yes. AI crawlers (GPTBot, ChatGPT-User, PerplexityBot, ClaudeBot) operate under tight per-host time budgets — when your origin negotiates HTTP/2 or HTTP/3, multiplexing lets the crawler fetch many resources over one connection, so it crawls more of your pages per session. Faster TTFB also improves LCP, which Google uses to rank pages eligible for AI Overviews. Sites stuck on HTTP/1.1 get fewer pages indexed and are less likely to be cited by ChatGPT, Perplexity, Claude, or Google AI Overviews.
HTTP/2 is the baseline modern web protocol — multiplexed, binary, and faster than HTTP/1.1 on virtually every multi-asset page. HTTP/3 is the next step, especially for mobile users. Both require HTTPS, and both are usually one toggle on your CDN. After enabling them, drop the legacy HTTP/1.1 workarounds (sharding, sprites, oversized bundles) so HTTP/2 can actually do its job. Run a Greadme deep scan to check which HTTP version your origin and assets serve and to surface upgrade opportunities.