The fix, in one snippet
listen 443 ssl;
http2 on;Illustrative values. Change the paths, hostnames and options to match your own site before using it.
The sections below explain what is tested, why it matters and the alternatives.
What we test
During the TLS handshake Scan.now offers the ALPN protocol identifiers h2 and http/1.1 and reads the server's selection. The check passes when h2 is chosen and is reported as informational when the server selects http/1.1 or sends no ALPN extension. Scan.now also reads any Alt-Svc header in the HTTPS response and notes when HTTP/3 (h3) is advertised. Cleartext HTTP/2 (h2c) on port 80 is not tested because browsers never use it. The result records the selected protocol and the ALPN list the server returned, which is also a quick way to see whether a CDN or load balancer, rather than your origin, is terminating TLS.
Why it matters
HTTP/2 (RFC 9113) multiplexes many requests over one connection, compresses headers with HPACK and lets the server prioritise streams, which typically makes page loads noticeably faster on high-latency links. The security relevance is indirect but real. Browsers only speak HTTP/2 over TLS, and RFC 9113 Appendix A blacklists the weak cipher suites for it, so turning it on nudges the TLS configuration toward the modern end. Fewer connections also mean fewer TLS handshakes for an attacker to observe. There is no downside for compatibility: every browser since 2015 supports it and falls back to HTTP/1.1 automatically. One operational note: HTTP/2 implementations have had their own bugs (the 2023 Rapid Reset denial-of-service, CVE-2023-44487), so keep the server patched as you would any other component.
How to fix it
Enable HTTP/2 on the TLS listener. nginx 1.25.1 or later uses a standalone directive; older versions take it as a listen parameter:
server {
listen 443 ssl;
http2 on; # nginx >= 1.25.1
# listen 443 ssl http2; # older nginx
...
}Apache 2.4.17+ with mod_http2 (requires the event or worker MPM; the prefork MPM cannot serve HTTP/2):
a2enmod http2
# in the VirtualHost or globally:
Protocols h2 http/1.1Cloudflare enables HTTP/2 and HTTP/3 at the edge by default (Speed > Optimization > Protocol Optimization), independently of what your origin speaks. Node.js applications usually get HTTP/2 from the reverse proxy in front of them; the core http2 module exists but Express does not support it natively. Verify:
curl -sI --http2 https://example.com/ | head -1
# HTTP/2 200The SSL and TLS guide explains ALPN and where HTTP/2 sits in the handshake.
Where this fits
HTTP/2 support is check 12 of 12 that the website vulnerability scanner runs under transport security (https / tls), ordered the way they are worth fixing. That ordering is the point: Fixing this one while the check above it still fails buys less than it looks like.
Fix this one first
Above it in the same category sits HSTS preload eligibility (info), where the domain does not yet meet the requirements for the browser HSTS preload list. An attacker who has that does not need this, so it is the better use of the same hour.
Found in the same scan
The website vulnerability scanner reports this alongside checks from other categories that are at least as serious, including Exposed .env configuration file, where a .env configuration file is served from the web root, and Exposed .git repository, where the site's .git directory is reachable over HTTP. A single run of website vulnerability scanner answers all of them at once.
The first few lines
You are a senior web engineer. I ran a security and SEO scanner against my site and it reported the finding below. Fix it properly rather than suppressing the symptom.
Finding: HTTP/2 support (info severity)
Scanner check id: http2-supportThe rest of this prompt names the pages and line numbers we found the problem on, the configuration to change, and the constraints a good answer has to respect. It is free, it just needs an account so the work is not scraped wholesale.
Sign in with GoogleSigning in is free and takes one click. We store your email address and nothing else.
