A year of HTTP/3: browser growth, but bots hold back

It has been roughly a year since the RFC that formalized HTTP/3 was published, and Cloudflare has taken another look at how the protocol versions are being used across its network. The company's previous assessment covered the period from May 2021 to May 2022. This new data snapshot covers the subsequent year, from May 2022 through May 2023.

The overall story for browser-driven traffic is one of continued, albeit modest, growth for HTTP/3. However, automated agents like search engine and social media crawlers have largely ignored the new protocol. While the low adoption by bots might seem surprising, the real-time, user-centric performance benefits of HTTP/3, as described in its specification, are arguably less relevant for asynchronous content indexing. On the other hand, API traffic, while still showing a small share for HTTP/3, did see its usage double over the course of the year.

The different transport layers help explain the adoption curve. HTTP/1.1 and HTTP/2 operate over TCP with TLS for security. HTTP/3 uses QUIC for both. Clients typically must discover HTTP/3 support, either through an HTTP Alt-Svc header advertising supported ALPN IDs or via DNS queries for the HTTPS record type. The ALPN ID for the final HTTP/3 spec is "h3". During the protocol's long development period, Cloudflare advertised draft-specific identifiers like "h3-29" to maintain compatibility with clients that hadn't yet updated. As of late May 2023, Cloudflare stopped advertising h3-29 for zones with HTTP/3 enabled, a move that saves a few bytes on every response and DNS record that previously included it.

HTTP version share across all traffic

A global view of all HTTP requests to Cloudflare shows that HTTP/1.1’s share declined from 8% to 7% between May and the end of September 2022, but then climbed above 11% through October. It remained elevated into January before settling back to 9% by May 2023. A notable weekday/weekend pattern became more prominent after this October increase.

HTTP/2 started the period at roughly 68% of requests and ended it just below 64%, showing little variance. HTTP/3 grew from just over 23% in May 2022 to more than 30% by August and September. It dipped to around 26% by November, and concluded the period at a 28% share.

APIs and attackers remain on older protocols

API traffic is a significant portion of Cloudflare's volume, yet a small fraction uses HTTP/3. Approximately half of API requests are made over HTTP/1.1, with another third over HTTP/2. The exception is growth: HTTP/3's share for APIs climbed from around 6% in May 2022 to over 12% a year later. The relatively low overall adoption here likely stems from the fact that HTTP/3 support in essential tools like curl is still considered experimental. Production-level support in such tools would likely accelerate growth for APIs and the web overall.

When looking strictly at requests that were mitigated by Cloudflare’s security solutions, the vast majority use HTTP/1.1 or HTTP/2. Less than 5% were made over HTTP/3. Attackers appear to find the older protocol versions sufficient, with no evident rush to upgrade tools for HTTP/3.

Desktop browsers: Safari closes the gap

Chrome began the survey period producing about 80% of HTTP/3 request volume, but its share fell to around 74% by May 2023. The difference was made up by Safari, which a year prior accounted for less than 1% of HTTP/3 traffic on Cloudflare. By May 2023, Safari's share grew to nearly 7%. This surge likely corresponds to HTTP/3 support in Safari moving from an "Experimental Features" developer setting to being natively supported in production releases.

Looking at the relative distribution across other browsers, Edge saw a modest bump from just under 10% to over 11% in June 2022, before gradually declining through the year. Firefox dropped slightly from around 10% to just under 9%.

For content requests by major browsers, HTTP/2 remains dominant, consistently handling 50-55% of Chrome and Edge volume, and about 60% for Firefox. The most dramatic shift was for Safari, where HTTP/2's share fell from nearly 95% in May 2022 to around 75% a year later. Concurrently, HTTP/3 usage on Safari grew from under 3% to nearly 18% over the same span. Chrome and Edge hovered around 40% for HTTP/3, and Firefox at roughly 35%, all showing pronounced weekday/weekend usage patterns. A less distinct version of that pattern emerged for Safari in late 2022.

An interesting anomaly was a general increase in HTTP/1.1 request share across all major desktop browsers in late October. The cause was high HTTP/1.1 volume from several large customer zones, but the underlying reason remains unclear.

Mobile browsers mirror their desktop counterparts

Mobile devices account for more than half of the request volume to Cloudflare, with Chrome Mobile alone generating over 25% of all requests. For Chrome Mobile and Chrome Mobile Webview, HTTP/1.1 usage is minimal, topping out under 5%. HTTP/2 dropped from 60% just below 55% between May and mid-September, and then recovered to near 60%. HTTP/3 followed a complementary path, growing from 37% to 45%, before falling back slightly to just below 40% where it held through May. These trends echo desktop Chrome's, but without the same clear weekday/weekend pattern.

Mobile Safari and Mobile Safari Webview patterns closely resembled those of desktop Safari, with an HTTP/1.1 rise in October and strong HTTP/3 growth from under 3% to nearly 18%.

Search bots stay behind

The minimal HTTP/3 usage from search engines continues its pattern from the prior year, with the protocol's optimizations for browsers rendering it of little use for asynchronous crawlers. GoogleBot continues to use HTTP/1.1 for 55-60% of its requests, with the balance nearly all HTTP/2. HTTP/3 usage peaked at just under 2% in March.

Data from Bing and Baidu is included through April 1, 2023, due to anomalous data in April that is under investigation. Microsoft’s BingBot sent approximately 85% of its requests over HTTP/2 through January, which then slipped to near 80%. The rest was HTTP/1.1, with no significant HTTP/3 use.

Russia's YandexBot uses HTTP/1.1 for almost all of its requests, with HTTP/2 usage typically around 1% outside of a spike of increased usage between late August and mid-November. Baidu's bot shows a strong preference for HTTP/1.1, used for over 85% of requests. Its HTTP/2 usage was characterized by significant but erratic spikes, briefly surpassing 60% on several days in July, November, and December 2022, and January 2023. HTTP/3 usage from both bots was effectively non-existent.

Social bots: still mostly HTTP/1.1 and HTTP/2

Social media platform bots have similar data trimming for the same anomaly-related reason, ending April 1, 2023.

Facebook's HTTP/3 usage for crawling was near zero. Its HTTP/1.1 request share declined over the year, from just under 60% to around 30%, while HTTP/2 usage climbed from just over 40% to over 70%. Meta engineers indicated this shift was a deliberate, gradual move away from HTTP/1.1.

TwitterBot maintained its strong preference for HTTP/2, accounting for 75-80% of requests through early October. That share then declined to just above 60% by April 2023, with a corresponding rise in HTTP/1.1. There remains no detectable HTTP/3 usage. The cause of a week-long HTTP/2 drop and HTTP/1.1 spike in late May 2022 is unknown.

LinkedIn's bot is the exception in this category. HTTP/3 usage grew from just under 1% in May 2022 to over 10% in April 2023. Its HTTP/2 usage continued its rise from the previous year, growing erratically from 5% to 15%. Despite these shifts, HTTP/1.1 remained the dominant protocol for LinkedIn's bot, with a share that fell from 95% to 75% over the year.

Outlook

HTTP/3 usage has generally increased for browser-based traffic, which is a positive sign for the protocol's adoption. There is significant room for further growth should production support arrive in key tools like curl, opening the door to wider API usage. While it's disappointing that search engine and social media bots have not adopted HTTP/3, the potential advantages may not be fully relevant for their asynchronous, automated tasks. These trends and others can be followed in the "Adoption and Usage" section of Cloudflare Radar.