Detects supported HTTP protocol versions
HTTP/1.1 request: sends a GET to the audited URL over HTTP/1.1 as 37AuditsBot and keeps only the headers. A blocked request ends the audit with 590. A timeout, DNS or TLS failure, or a status other than 2xx ends it with 500.
HTTP/2 request: sends the same GET offering HTTP/2 and records the version the server negotiated (HTTP/2 or HTTP/1.1).
Alt-Svc: reads the Alt-Svc headers of both answers and looks for an h3 token (h3, or a draft such as h3-29).
Rules: HTTP/1.1 without an HTTP/3 advertisement fails (400). HTTP/2 without an HTTP/3 advertisement warns (300).
Aggregate: FAIL wins over WARNING. An HTTP/3 advertisement is SUCCESS (200).
Every row maps to one checkRule* method and one CheckCode, in the order the auditor runs them. CheckCode suffixes use status ranges: 200 success, 300–399 warning, 400–499 fail, 500–599 error.
| CheckCode | Status | When it fires | Recommendation | Why it matters |
|---|---|---|---|---|
37A-HTTPVersionAuditor-400 | FAIL | The server answers the HTTP/2 offer with HTTP/1.1 and advertises no HTTP/3 in Alt-Svc. | Enable HTTP/2 on {server} (or the CDN in front of it) for {host}, then advertise HTTP/3 with an Alt-Svc: h3=":443" header. | HTTP/1.1 loads a page's files a few at a time, so every page takes longer to appear, most of all on mobile networks. Slower pages lose visitors and rank lower in search. |
37A-HTTPVersionAuditor-300 | WARNING | The server negotiates HTTP/2 but advertises no HTTP/3 in Alt-Svc. | Turn on HTTP/3 (QUIC) on {server} or your CDN for {host}, and send Alt-Svc: h3=":443"; ma=86400 so browsers can upgrade. | HTTP/3 keeps pages fast on unreliable mobile and Wi-Fi connections, where HTTP/2 stalls after a lost packet. Without it, visitors on poor networks wait longer for every page. |
37A-HTTPVersionAuditor-200 | SUCCESS | All rules passed. Message is {url} advertises HTTP/3 ({h3Token} in Alt-Svc) and negotiated {version}. | — | — |
37A-HTTPVersionAuditor-500 | ERROR | The audited page could not be fetched: timeout, DNS or TLS failure, or a status other than 2xx (HTTP 404, HTTP 5xx). | Make sure {url} answers with HTTP 2xx, then run the audit again. Last error: {error}. | — |
37A-HTTPVersionAuditor-590 | ERROR | The audited page answered HTTP 403, HTTP 429 or a Cloudflare challenge, so 37AuditsBot was blocked before it could read the page. | Allow 37AuditsBot in your firewall or bot protection: allowlist its user agent, or verify its Web Bot Auth signature. See https://www.37audits.com/bot. | While 37AuditsBot is blocked this audit cannot look at the site, so problems on it go unreported. |
| Status | Description | Test logic |
|---|---|---|
| SUCCESS | The site advertises HTTP/3 | An h3 token in Alt-Svc (200). |
| WARNING | HTTP/2 works, HTTP/3 is not advertised | HTTP/2 negotiated, no h3 token (300). |
| FAIL | The site only speaks HTTP/1.x | HTTP/1.1 negotiated, no h3 token (400). |
| ERROR | The auditor could not fetch the page | Timeout, DNS or TLS failure, or a status other than 2xx (500); site blocked 37AuditsBot (590). |
HTTP/1.1 opens a handful of connections and queues every other file behind them. On a page with many assets this adds round trips, and the delay grows with network latency.
HTTP/2 sends every file over one connection at once, but runs on TCP: one lost packet holds up every file until it is resent.
HTTP/3 runs on QUIC (UDP), so a lost packet delays only the file it belongs to, and the connection survives switching between Wi-Fi and mobile data.
Most CDNs (Cloudflare, Fastly, CloudFront, Akamai) offer HTTP/2 and HTTP/3 as a setting. Behind a CDN, the CDN's edge is what this auditor sees.
On your own server, HTTP/2 needs TLS with ALPN (nginx http2 on;, Apache mod_http2). HTTP/3 needs UDP port 443 open and a server built with QUIC support, plus the Alt-Svc header.
HTTP/3 is detected from the Alt-Svc advertisement only: the auditor does not open a QUIC connection, so it cannot tell whether UDP 443 is reachable.
A draft token such as h3-29 counts as an advertisement, although current browsers only use h3.
Plain http:// URLs cannot negotiate HTTP/2 the way browsers do (browsers use HTTP/2 only over TLS), so audit the https:// address.
This documentation is built and hosted on Mintlify, a developer documentation platform.
Add this auditor to your monitoring setup and start identifying issues on your websites today.