A slow page loses visitors before it has shown them anything. Part of that delay comes from neither the images nor the code, but from the way the browser and the server talk to one another: the HTTP protocol, and the TLS layer that encrypts it.
HTTP/2 reshaped that conversation in 2015. HTTP/3 has extended it since 2022 on a different transport, and TLS 1.3 cut the handshake before every secure connection from two round trips to one.
So does HTTP/3 make sites faster? Sometimes, for some visitors, on some metrics — and rarely enough on its own to rescue a page that is slow for other reasons. What follows separates the part of loading time the protocol controls from the part it cannot touch. Figures are current as of September 2026, from W3Techs, Cloudflare Radar, the HTTP Archive Web Almanac and Google's documentation.
Why the protocol weighs on speed
Under HTTP/1.1 a browser usually opens around six connections per hostname and sends requests one after another on each. A modern page pulls dozens of files: stylesheets, scripts, fonts, images. Every connection needs its own TCP set-up, then a TLS handshake, before a single useful byte moves. On a mobile network each extra round trip costs tenths of a second.
Recent protocols attack those round trips. They do not make the page lighter; they cut the waiting.
HTTP/2: a baseline most hosting now provides
HTTP/2 carries every resource from one origin over a single connection, in parallel (multiplexing), compresses headers and lets the browser signal its priorities. Server push, much discussed at the time, was dropped by Chrome in 2022; its role has been taken by 103 Early Hints responses and by preloading declared in the HTML.
The specification does not require encryption, but browsers only speak HTTP/2 over HTTPS. In practice: no certificate, no HTTP/2. That is no longer an obstacle, since a Let's Encrypt certificate costs nothing and most hosting control panels issue one for you.
Two measurements give the scale, and they count different things:
- According to W3Techs (September 2026), 34.8% of websites are served over HTTP/2, and 40.7% advertise HTTP/3 — counted per site, across the sites W3Techs tracks.
- According to Cloudflare Radar's 2025 year in review, 50% of requests reaching the Cloudflare network between 1 January and 2 December 2025 used HTTP/2, 29% HTTP/1.x and 21% HTTP/3, a split the report calls largely unchanged from 2024 — counted per request, on Cloudflare traffic only.
Either way, HTTP/1.1 still carries close to a third of that traffic. If your site is in that group, that is the first thing to correct.
HTTP/3 and QUIC: a gain concentrated on mobile networks
HTTP/3, standardised in June 2022 as RFC 9114, drops TCP for QUIC, a transport built on UDP with TLS 1.3 folded into it. Three concrete effects:
- No more head-of-line blocking. Under HTTP/2, one lost packet holds up every resource on the connection. With QUIC, only the affected resource waits.
- Faster connection set-up. Transport and encryption are negotiated in a single round trip, or none at all for a returning visitor.
- Continuity when moving. Switching from Wi-Fi to mobile data no longer drops the connection, identified by a token rather than by the IP address.
The benefit is clear on unstable networks and modest on a stable fixed line, which partly explains the plateau Cloudflare observes. Advertising HTTP/3, through the Alt-Svc header or an HTTPS DNS record, does not guarantee the browser will use it on a first visit.
How to enable it
It depends on the layer that answers the browser. LiteSpeed, Caddy and recent versions of Nginx support HTTP/3; Apache does not do so natively. On shared hosting you do not choose the server software, so read the plan's specification or test. A CDN in front of the site (Cloudflare, Bunny, Fastly and others) serves HTTP/3 whatever the origin runs. Which layer is responsible is the kind of question a technical SEO audit settles before anyone touches a configuration file.
TLS 1.3 and certificates: what changes in 2026
TLS 1.3 (RFC 8446, 2018) establishes the encrypted session in one round trip instead of two and removes obsolete algorithms. It is mandatory for HTTP/3. On your server the target is simple: TLS 1.3 enabled, TLS 1.2 kept for older clients, TLS 1.0 and 1.1 switched off.
Certificates are getting shorter
The CA/Browser Forum, which brings together certificate authorities and browser makers, adopted the SC-081v3 schedule in April 2025: maximum certificate lifetime cut from 398 to 200 days since 15 March 2026, down to 100 days from 15 March 2027, then 47 days from 15 March 2029. Manual renewal becomes untenable; ACME automation, already the rule at Let's Encrypt, is now everyone's problem. Let's Encrypt has even offered optional 160-hour certificates — a little over six days — since 15 January 2026.
Chrome will warn before plain HTTP pages
Google announced on 28 October 2025 that in Chrome 154, expected in October 2026, the "Always use secure connections" setting will be on by default: the browser will show a warning, dismissable by the visitor, before loading a public site without HTTPS. Private addresses such as intranets are exempt. Google states that 95% to 99% of navigations to public sites already use HTTPS, depending on the platform. A site still on plain HTTP will be presented to visitors as a risk, on top of the effects on search visibility.
Core Web Vitals in 2026: what Google measures
The three metrics and their thresholds have not changed since March 2024, when INP replaced FID as the responsiveness metric. Google evaluates them at the 75th percentile of real visits recorded by Chrome (the CrUX dataset), mobile and desktop separate, over a rolling 28-day window. Search Central states that Core Web Vitals are used by its ranking systems, while repeating that a relevant page comes before a fast one.
| Metric | "Good" threshold | What HTTP/2, HTTP/3 or TLS 1.3 change |
|---|---|---|
| LCP (largest element rendered) | 2.5 s or less | Yes: faster connection, resources loaded in parallel, lower TTFB. |
| INP (responsiveness to interactions) | 200 ms or less | No: depends on the JavaScript running on the page. |
| CLS (visual stability) | 0.1 or less | No: depends on the space reserved for images, fonts and embeds. |
The HTTP Archive Web Almanac 2025 (CrUX data from July 2025, millions of sites) measures 48% of sites with good Core Web Vitals on mobile, against 44% in 2024, and 56% on desktop. LCP remains the weak point: 62% of sites rated good on mobile, and only 44% for TTFB, the server response time, which the protocol and the hosting influence directly.
A good protocol helps LCP. It does nothing for an INP wrecked by a chat widget, or a CLS caused by a consent banner.
Check your site in ten minutes
From a terminal, two commands tell you most of what the server negotiates. The second reads the Alt-Svc header, which is how a server advertises HTTP/3; testing --http3 directly needs a curl build compiled with HTTP/3 support.
curl -I --http2 https://example.com/
curl -sI https://example.com/ | grep -i alt-svc- Protocol in use. In Chrome or Firefox, open the developer tools, Network tab, and display the "Protocol" column:
h2means HTTP/2,h3means HTTP/3,http/1.1means there is a problem. Reload once more, since HTTP/3 is often negotiated only from the second visit. - Field data. PageSpeed Insights shows real Core Web Vitals from CrUX if your traffic is high enough; otherwise the Search Console report covers all your URLs.
- TLS configuration. The Qualys SSL Labs test lists the TLS versions accepted, the certificate chain and its expiry date.
- Redirects. One single 301 from HTTP to HTTPS, without a with-www or without-www variant as an intermediate hop.
- Mixed content. No image or script loaded over
http://on an HTTPS page; the browser console lists them. - Renewal. Check that the certificate renews automatically and that a failure raises an alert.
When to act, and when to leave it alone
- The site answers over HTTP/1.1. That points to dated hosting or configuration. Enable HTTP/2 with your host, or move plan: the gain is real and the cost low.
- HTTP/2 is on, HTTP/3 is absent. Worth adding if your audience is mostly mobile or far from the server. Otherwise it is low priority, and a free CDN tier often provides it.
- TTFB is above 800 ms. The protocol cannot help. Look at server-side caching, plugins, the database or the size of the plan — the usual suspects behind an ageing WordPress build.
- LCP stays poor regardless. Image weight, render-blocking fonts, third-party scripts: that is the territory of website speed optimisation, not of the transport layer.
- All three metrics are already good. Moving to HTTP/3 will not change your rankings. Spend the budget on content or conversion instead.
The protocol is a foundation: necessary, and invisible once laid. Check it once, automate the certificate, then go back to what your visitors actually see.
Common questions
Does HTTP/2 work without HTTPS?
In practice, no. The specification allows an unencrypted version, but Chrome, Firefox, Safari and Edge only use HTTP/2 over HTTPS. Without a valid certificate the browser falls back to HTTP/1.1.
Does HTTP/3 replace HTTP/2?
No, the two coexist. The server advertises HTTP/3 and the browser switches if it supports it; otherwise it stays on HTTP/2. Across 2025, around a fifth of requests on the Cloudflare network used HTTP/3, against half on HTTP/2.
How much faster will my pages actually be?
There is no honest single figure, because it depends on where the time goes now. Moving from HTTP/1.1 to HTTP/2 on a page with many small files is usually visible; moving from HTTP/2 to HTTP/3 on a fast fixed line often is not. Measure LCP and TTFB before and after.
Do I need a paid certificate to get HTTP/2 or HTTP/3?
No. A free Let's Encrypt certificate provides the same encryption as a paid one and is enough for HTTP/2, HTTP/3 and TLS 1.3. Paid products differ on organisation validation, warranty and support, not on speed.
What happens if my certificate expires?
Browsers show a full-page warning and most visitors leave. Since March 2026 the maximum certificate lifetime has been 200 days, and 100 days from March 2027, so automated renewal and a monitoring alert are no longer optional.
Have the Core Web Vitals thresholds changed in 2026?
No. LCP at 2.5 seconds or less, INP at 200 milliseconds or less, CLS at 0.1 or less, at the 75th percentile of real visits. The last metric change was March 2024.