Direct answer: of 25 homepages, 23 completed a TLS handshake: 12 negotiated h2 via ALPN, 10 chose http/1.1 and one negotiated neither (E01). No page returned Alt-Svc, so HTTP/3 advertising is zero. 21 homepages returned HTTP 200; E13 and E27 failed certificate verification and E04 and E16 failed the handshake, so they produced no HTTP response.
This study measures protocol negotiation and the Alt-Svc header only; it sends no HTTP/2 business request and does not judge page load speed.
Method: ALPN handshake plus one header-only request
On 2026-11-08 between 06:40 and 06:41 we ran a TLS handshake with SNI against the final host of each of the 25 homepages from study 4, offering h2,http/1.1 via ALPN and recording the selected protocol and TLS version. A single GET then read the response headers only (12-second timeout) for Alt-Svc, without storing the body. Failures were not retried: E04 and E16 had already failed repeatedly in the TLS check.
| Item | Rule | Boundary |
|---|---|---|
| h2 | ALPN selected h2 | Handshake capability, not proof the page uses h2 |
| http/1.1 | ALPN selected http/1.1, or no ALPN but an HTTP response | — |
| No ALPN | Handshake ok without a selected protocol | Browsers fall back to HTTP/1.1 |
| Alt-Svc | Header present | Missing does not prove the CDN lacks h3 |
| h3 advertised | Alt-Svc contains h3 or h3-* | No QUIC connection is opened |
Result: 12 on h2, 10 on http/1.1
| ALPN result | Sites | Share of 25 |
|---|---|---|
| h2 | 12 | 48.0% |
| http/1.1 | 10 | 40.0% |
| No ALPN | 1 | 4.0% |
| Handshake failed | 2 | 8.0% |
h2 is the relative majority but not the default: 10 sites still negotiate http/1.1, and one (E01) offers no ALPN over TLS 1.2, so browsers fall back to 1.1. For this batch of equipment homepages, HTTP/2 looks partly enabled rather than a shared baseline.
Cross-check with TLS: h2 does not require TLS 1.3
| TLS version | h2 | http/1.1 | No ALPN | Total |
|---|---|---|---|---|
| TLS 1.3 | 11 | 7 | 0 | 18 |
| TLS 1.2 | 1 | 3 | 1 | 5 |
| Handshake failed | — | — | — | 2 |
E25 negotiated h2 over TLS 1.2, so protocol version and ALPN are independent: upgrading to TLS 1.3 does not enable h2 automatically, and h2 does not require 1.3. Conversely, seven of the 11 TLS 1.3 sites still negotiate only http/1.1, so the server or CDN has not enabled h2.
Alt-Svc: none of 25 advertises HTTP/3
None of the 21 successful responses returned Alt-Svc, so h3 advertising is zero. Browsers only try HTTP/3 after seeing Alt-Svc: h3=":443"; ma=...; without it, h3 support stays undiscoverable even when a CDN offers it. Possible reasons include origin configuration, a disabled CDN feature, or header rewriting by an intermediary; this study records presence only and does not attribute the cause.
| Alt-Svc and HTTP/3 | Sites | Note |
|---|---|---|
| Alt-Svc present | 0 | — |
| h3 advertised | 0 | — |
| No Alt-Svc | 21 | Browsers will not try h3 |
| No HTTP response | 4 | E04, E13, E16, E27 |
What this means for acceptance
- Make h2 an explicit check. Ten of the 23 completed handshakes still choose http/1.1; HTTPS alone does not imply h2.
- Check both CDN and origin. Seven TLS 1.3 sites still serve only 1.1, so the gap may be at the edge or on the origin.
- h3 has not arrived in this batch. Zero Alt-Svc means not even advertising; enabling h3 starts with CDN switches and header rewriting.
- ALPN is capability only. Negotiating h2 does not prove every page uses it; check request logs or developer tools.
- Regression-test protocol upgrades. Certificates, caching, WAF and compression can all change with protocol; see the website development service checklist.
Limits
- Negotiation only: no HTTP/2 business request was sent, so application behaviour and load performance are untested.
- No h3 connection: Alt-Svc is read but no QUIC connection is opened and UDP 443 reachability is not tested.
- One snapshot: 2026-11-08 06:40–06:41; CDNs and WAFs may vary by region or time.
- Four sites without HTTP data: E04 and E16 failed the handshake; E13 and E27 failed certificate verification; see the homepage HTTPS certificate and TLS pilot.
- 25-site pilot: no industry claim.
Data and reproduction
Anonymised data: equipment-homepage-http-protocol-2026.csv (25 rows × 11 columns: handshake status, TLS version, raw and classified ALPN, HTTP status, Alt-Svc presence, h3 flag, max-age, check time, error type). The repository keeps docs/research/2026-11-homepage-http-protocol.csv.
Parser: scripts/http_protocol_probe.py; unit tests: scripts/test_content_http_protocol.py (10 tests, no network). Run:
python -m unittest scripts.test_content_http_protocol
Related: the homepage HTTPS certificate and TLS pilot, the homepage canonical and scheme-redirect pilot, and the homepage cache, compression and revalidation pilot.
Sources and definitions
- Sample: the final hosts of the 25 homepages from study 4 (same sample_id).
- ALPN: Python
ssl, protocol listh2,http/1.1, SNI with the hostname, 6-second timeout. - Alt-Svc: one GET to the same host, headers only, 12-second timeout, body not stored.
- Classification: ALPN values recorded verbatim; Alt-Svc parsed by protocol identifier as in RFC 7838.
Frequently asked questions
Does negotiating h2 mean the page is faster?
Not necessarily. Whether multiplexing helps depends on resource count, concurrency and server implementation; this study records negotiation only and does not measure load time.
Why is HTTP/3 advertising zero?
None of the 21 successful responses sent an Alt-Svc header. Browsers only try HTTP/3 after seeing Alt-Svc: h3=":443"; without it, h3 support stays undiscoverable even if the CDN offers it.
Does h2 require TLS 1.3?
No. E25 negotiated h2 over TLS 1.2; TLS version and ALPN protocol are separate dimensions.
Why are E04 and E16 missing?
Both failed during the TLS handshake: E04 timed out and E16 returned an internal TLS alert, so no ALPN could be read.
Do 25 sites represent the industry?
No. This is the same 25 equipment-company homepages from study 4; it describes only these pages.
Can the data be re-checked?
Yes. The public CSV has 25 rows by 11 columns; scripts/http_protocol_probe.py has 10 offline unit tests.