HTTP and TLS protocol versions

What this request actually negotiated: the HTTP version it ran over, whether HTTP/3 is offered in Alt-Svc, and the TLS version the handshake settled on.

• Help center

This row shows what the scan's own request to the entry page actually negotiated with the server, not what the server could do in theory.

What is listed

• HTTP version — HTTP/1.1, HTTP/2 or HTTP/3, as used by this connection. HTTP/2 sends many files over one connection at the same time; a site still on HTTP/1.1 gets a low-severity note in the report, because it loads noticeably slower on pages with many assets.
• HTTP/3 — listed as offered when the response advertises it in the Alt-Svc header (h3=":443"). Browsers switch to it on later requests, so a first request over HTTP/2 is normal. See HTTP/3.
• TLS version — the version the handshake settled on, normally TLS 1.3 or 1.2. Which older versions the server still accepts is a separate check, TLS versions.

The row is informational and always green when present.

Improving it

HTTP/2 is on by default in most current servers and CDNs; in nginx it is listen 443 ssl; http2 on; (or http2 on the listen line in older versions), in Apache Protocols h2 http/1.1 with mod_http2. HTTP/3 needs UDP port 443 open and a server or CDN that supports QUIC — often just a switch in the CDN dashboard. Prefer TLS 1.3 wherever the server offers it.