What HTTP/3 changes for a visitor
HTTP/2 made one TCP connection carry many requests at once, but it inherited TCP's rule that a lost packet holds up everything behind it. HTTP/3 replaces TCP with QUIC, a transport over UDP with TLS 1.3 built in: each request stream recovers from loss on its own, the handshake needs fewer round trips, and a phone that moves from Wi-Fi to mobile data keeps its connection instead of restarting it. On good wired connections the gain is small; on lossy Wi-Fi and mobile networks — where most of your visitors are — it is the difference that shows up in Core Web Vitals.
How the edge moves browsers over, and back
Every HTTPS response from the edge carries Alt-Svc: h3=":443". A browser that understands it opens its next connection over QUIC on UDP port 443; one that does not simply ignores the header. If UDP 443 is blocked somewhere on the path — a corporate firewall, a strict home router — the browser notices the QUIC attempt failing and stays on HTTP/2 without any error. That is why HTTP/3 can be on for everyone: the worst case is exactly what you had before.
IPv6 without touching your origin
The CDN hostnames carry AAAA records next to their A records and the edge listens on both address families. A visitor on an IPv6-only network — common on mobile carriers — connects to the edge directly instead of going through the carrier's translation layer, and a tender or compliance checklist that asks for IPv6 gets a yes. Your origin server is contacted the way it is today, usually IPv4, so nothing on it has to change for your site to be reachable over IPv6.
The same WAF on every protocol
The Web Application Firewall, rate limits, country and ASN rules and bot protection inspect an HTTP/3 request exactly as they inspect an HTTP/2 request; the protocol is a transport detail below them. A blocked request over HTTP/3 gets the same block page with the same Reference ID, so support and audits work unchanged. The only rule that needs your attention is one you wrote against IPv4 addresses: IPv6 visitors do not match it until you add the IPv6 form.
What it costs you
Nothing. There is no plan, add-on or setting for either feature, bandwidth and requests are counted as before, and the edge capacity behind them is ours to run — we measured the switch across the network and saw no change in load. Both features are shared edge configuration and cannot be turned off for one site; they do not need to be, because clients that cannot use them lose nothing.
Nothing to set up — here is how to confirm it
Open DevTools and enable the Protocol column
In Chrome, Edge or Firefox open DevTools → Network, right-click a column header and tick Protocol. Load your site once, then reload: the first load shows h2, the reload shows h3 on your own requests.
Ask with curl
curl 8 with HTTP/3 support can force the protocol: curl --http3 -sI https://www.example.com/ returns HTTP/3 200. Without the flag, curl -sI shows the Alt-Svc header that announces h3 to browsers.
Check the IPv6 records
dig +short AAAA www.example.com lists the IPv6 addresses of the edge; curl -6 -sI https://www.example.com/ fetches the page over IPv6. If your DNS is a CNAME to us, both are inherited automatically.
Read your logs
Requests over HTTP/3 are logged with the protocol HTTP/3.0 and IPv6 visitors with their IPv6 addresses. The share depends on your audience; on the first day it ranged from 6% to 27% of requests per site.
Where it shows
Most of a news audience reads on phones over mobile data, where packet loss is normal. Image-heavy article pages over HTTP/3 stop stalling on a single lost packet, and readers switching between Wi-Fi and 4G keep their connection.
Public-sector and enterprise questionnaires increasingly ask for IPv6 reachability and modern transport support. Both are answered with a yes and a curl command, for every hostname behind the CDN, without a project on your side.
Several mobile operators hand out IPv6 only and translate IPv4 in the core. Your site now answers those visitors natively at the edge, which removes one shared middlebox from the path and its failure modes.
Frequently asked questions
Do I have to enable HTTP/3 or IPv6 for my account?
No. Both are on for every hostname served by the edge since September 2026. There is no switch in the panel, and nothing in your DNS or origin needs to change if you already point at us with a CNAME.
My browser shows h2, not h3. Is HTTP/3 not working?
The first request of a session is always HTTP/2 — that is where the browser learns about h3. Reload the page. If it still shows h2 on every request, something on your network blocks UDP port 443; browsers then stay on HTTP/2 silently. Test from a phone on mobile data to confirm.
Does my origin server need IPv6?
No. The edge terminates the visitor's connection, whichever family it arrives on, and fetches from your origin over the address family it has today. Only the visitor-facing side became dual-stack.
Is the WAF weaker over HTTP/3?
No. The same rules run on every request regardless of transport, and a blocked HTTP/3 request receives the same block page and Reference ID as one over HTTP/2.
Can HTTP/3 be turned off for one site?
No, and it does not need to be: a client that cannot use QUIC keeps using HTTP/2 automatically. Turning the announcement off would only remove the speed-up for clients that can.