Web Protocols
Every request your browser makes rides a stack of protocols: an application protocol like HTTP, a security layer like TLS, and a transport like TCP or QUIC underneath. Each generation traded away a bottleneck of the last — head-of-line blocking, extra round trips, plaintext exposure — to make the web faster and safer.
This section explains the protocols WebInspect detects: what each one is, where it sits in the stack, how its handshake and framing work, and the concrete performance and security reasons to prefer the newer versions.
- HTTP/1.0The first widely documented version of HTTP, which introduced headers, status codes and content types — but opened and closed a fresh TCP connection for every single request.
- HTTP/1.1The workhorse of the web for two decades: persistent connections, chunked transfer, pipelining and the mandatory Host header that made virtual hosting possible.
- HTTP/2A binary, multiplexed protocol that carries many concurrent requests over one TCP connection and compresses headers with HPACK — eliminating HTTP/1.1's application-layer head-of-line blocking.
- HTTP/3HTTP carried over QUIC and UDP rather than TCP — independent streams end transport head-of-line blocking, and built-in TLS 1.3 plus 0-RTT slash connection setup latency.
- QUICThe modern transport under HTTP/3: multiplexed streams with independent loss recovery, TLS 1.3 baked in, 0-RTT resumption and connection migration — all on top of UDP.
- WebSocketA full-duplex, persistent channel for real-time apps — chat, live dashboards, multiplayer — established by upgrading an ordinary HTTP request and then speaking a lightweight message framing.
- gRPCA high-performance RPC framework built on HTTP/2 and Protocol Buffers, with unary and streaming calls — popular for service-to-service communication where efficiency and strict contracts matter.
- TLS 1.3The current, fastest and safest TLS version: a one round-trip handshake, forward secrecy by default, optional 0-RTT resumption, and the removal of the weak ciphers that plagued earlier versions.
- TLS 1.2The previous TLS version — still secure when configured with modern AEAD ciphers and forward secrecy, but slower than 1.3 and burdened with many insecure options that must be disabled.
- TLS 1.0, 1.1 & SSLThe obsolete encryption protocols — SSL 2.0/3.0 and TLS 1.0/1.1 — broken by attacks like POODLE and BEAST. They must be disabled entirely; keeping them enabled is a serious vulnerability.
- mTLSTLS where both sides prove their identity with certificates, not just the server. A cornerstone of zero-trust networks and secure service-to-service communication.
- ALPNThe quiet TLS extension that lets a client and server agree on HTTP/2 versus HTTP/1.1 inside the TLS handshake — with zero extra round trips. Without it, browser HTTP/2 would not exist.
- TCPThe reliable transport under most of the web: a three-way handshake, guaranteed in-order delivery, retransmission and congestion control. Rock-solid, but its strict ordering causes head-of-line blocking.
- UDPA minimal, connectionless transport: no handshake, no ordering, no retransmission — just fast datagrams. The blank canvas QUIC builds reliability on top of to power HTTP/3.
- DoH & DoTTwo ways to encrypt DNS so queries cannot be read or altered in transit: DoH tunnels DNS inside HTTPS on port 443, while DoT uses a dedicated TLS connection on port 853.