HTTP/3 and QUIC support
Whether the server offers HTTP/3. It opens connections in fewer round trips, which shows up most on mobile networks. Optional.
HTTP/3 is the newest version of HTTP. Instead of TCP it runs over QUIC, a UDP-based protocol with TLS 1.3 built in. A new connection needs fewer round trips before data flows, and one lost packet no longer holds up every other file on the same connection. The difference is most noticeable on mobile networks with high latency and packet loss; on a fast wired connection it is small.
How SiteScan checks it
Browsers learn about HTTP/3 from the Alt-Svc header, which advertises it for the next connection. The scanner reads that header on the home page: the HTTP/3 row of the Delivery & reputation group then reads “Offered” with a green tick, and HTTP/3 is also listed in the protocols row of the Technology group. “Not offered” comes with a grey dash, not a warning — HTTP/3 is optional, and a site on HTTP/2 is perfectly healthy.
How to enable it
- CDNs such as Cloudflare, Fastly or CloudFront offer HTTP/3 as a switch in the settings — the simplest route.
- nginx 1.25 and later:
listen 443 quic reuseport;alongside the usuallisten 443 ssl;,http3 on;andadd_header Alt-Svc 'h3=":443"; ma=86400';. - Open UDP port 443 in the firewall, otherwise browsers silently fall back to HTTP/2.
Browsers always keep HTTP/2 as a fallback, so enabling HTTP/3 does not lock anyone out. Speed itself is measured in Core Web Vitals.
See this check on your own site
Run a free scan: the report shows this row for your domain along with the other checks of the site audit.
More in “Delivery & reputation”
What SiteScan checks
TLS certificate
- TLS certificate expiry
- Outdated TLS versions (TLS 1.0/1.1)
- TLS certificate chain
- TLS certificate issuer
- Certificate signature algorithm
Domain registration
- Domain registration expiry
- Registered domain name
- Domain registrar
- Domain registration date
- Domain last updated date
- Domain status codes (EPP)
- Domain transfer lock
- Registrar abuse contact
- RDAP and WHOIS data source
Indexing
- robots.txt file
- CSS and JS blocked in robots.txt
- XML sitemap
- Sitemap index file
- Off-domain URLs in the sitemap
- Sitemap lastmod dates
- Broken URLs in the sitemap
- RSS and Atom feed
Addresses & redirects
Security headers
- HTTP security headers and grade
- Strict-Transport-Security (HSTS) header
- Content-Security-Policy (CSP) header
- X-Content-Type-Options: nosniff
- X-Frame-Options and clickjacking
- Referrer-Policy header
- Permissions-Policy header
- HSTS preload list
- CORS and cross-origin reads
- HTTP TRACE method
Delivery & reputation
- Cache-Control header for HTML
- ETag and Last-Modified revalidation
- HTTP/3 and QUIC support
- Server version disclosure in headers
- DNS blocklist (DNSBL) check
Internal links
Exposure
- Exposed sensitive files (.env, .git, backups)
- Directory listing enabled
- Public JavaScript source maps
- Exposed WordPress endpoints
Well-known files
- security.txt file
- llms.txt for AI assistants
- llms-full.txt file
- ads.txt authorized sellers file
- humans.txt file
- Well-known change-password URL
DNS & email
- MX records (mail servers)
- SPF record
- DMARC record and policy
- DNSSEC signing
- CAA record
- Nameserver redundancy
- IPv6 support (AAAA record)
- MTA-STS policy
- TLS-RPT reporting record
- BIMI record (brand logo in email)
- Wildcard DNS record
- Dangling CNAME and subdomain takeover
Privacy & consent
- Analytics and tracking scripts
- Cookie consent banner
- Privacy policy link
- Terms of service link
- Imprint (Impressum)
- Accessibility statement
Core Web Vitals
- Lighthouse performance score
- Largest Contentful Paint (LCP)
- Cumulative Layout Shift (CLS)
- Interaction to Next Paint (INP)
- CrUX field data vs lab data