HTTP Protocol Check (http-protocol-check)

Summary

HTTP/2 and HTTP/3 (QUIC) advertisement and negotiation checks.

Classification

• Category: PERFORMANCE
• Plugin id: http-protocol-check
• Version: 1.0.0
• Target types: WEBSITE, API, WEBSHOP
• Weight class: LIGHT
• Risk level: not set on plugin object
• Browser required: No (HTTP / Node / other — see source)
• Tier / group: Tier 1 — HTTP-only

Schedule

• scheduleHints: { defaultInterval: '0 */6 * * *', priority: 6 }
• Prerequisites: None declared on this plugin.

Configurable inputs

Public keys are derived from inputSchema: z.object({ ... }) (underscore-prefixed keys are runtime-only and omitted here).

Field	Notes
timeout	Zod field in inputSchema — see source for defaults, min/max, and .describe().

Runtime / injected config

• None documented beyond standard worker context (target, config, logger, reportProgress). Underscore-prefixed keys are internal.

Checks that produce findings

These checks run inside this plugin during a single test run. They are not separate tests in the database — each becomes a Finding linked to the Run for http-protocol-check.

Check	Typical severity	Why
Site not served over HTTPS	WARNING	HTTP/2 and HTTP/3 checks require TLS; plain HTTP returns early with score 30.
HTTP/2 not supported	WARNING	Direct http2.connect failed — no multiplexing/header compression benefits.
HTTP/3 (QUIC) not advertised via Alt-Svc	INFO	HEAD response lacks Alt-Svc containing h3 — QUIC not advertised to browsers.
ALPN negotiates HTTP/1.1 despite HTTP/2 support	INFO	TLS ALPN returned http/1.1 while separate HTTP/2 connection succeeded — possible TLS misconfiguration.

How each check works

1. HTTPS gate — Non-HTTPS targets get a single WARNING and skip protocol probes.
2. ALPN probe — TLS connect with ALPNProtocols: ['h2', 'http/1.1'], read negotiated protocol (rejectUnauthorized: false for ALPN read).
3. HTTP/2 — http2.connect to host; success → supported, capture ALPN if available.
4. HTTP/3 signal — HEAD target URL; inspect Alt-Svc for /h3/i.
5. Findings — Emit per table above; ALPN mismatch only when H2 works but ALPN is http/1.1.
6. Score — −30 no H2, −10 no H3 advertisement.

Caveats and concerns

• CDN vs origin — Probes hit the hostname from the target URL; may reflect edge config, not origin server.
• H3 not fully tested — Only checks Alt-Svc advertisement, does not perform QUIC handshake.
• ALPN TLS relaxed — ALPN check uses rejectUnauthorized: false to complete handshake; cert issues do not block the test.
• Port override — Non-default ports from URL are used for ALPN; HTTP/2 connect uses default HTTPS port in helper.
• API targets — Same checks apply to API URLs if served over HTTPS.

Source

packages/test-plugins/src/plugins/http-protocol-check.ts