HTTP/3 is the latest version of HTTP, and it runs over QUIC instead of TCP. QUIC uses UDP, so a lost packet does not stall every stream the way classic head-of-line blocking can on TCP. On our shared hosting, LiteSpeed already speaks HTTP/2 and can speak HTTP/3 when the path allows it. You do not turn this on with a WordPress plugin, and you cannot force it from .htaccess.
What ports need to stay open
TCP 443 carries HTTP/2 and older HTTPS. UDP 443 is what HTTP/3 needs. Port 80 should stay open for AutoSSL HTTP-01 checks and for your redirect to HTTPS. If something filters UDP, the browser simply uses HTTP/2, and that is normal success rather than a failure. Do not close port 80 to “force modern HTTP,” because Let’s Encrypt AutoSSL on cPanel still depends on it.
curl -I –http2 https://example.com/
curl -sI https://example.com | headAsk for HTTP/2 first. A 200 response with HTTP/2 in the status line means the origin is healthy. HTTP/3 only appears when the client and the network both support it. A failed --http3-only test from one office does not mean your site is down. In Chrome, the Protocol column in Developer Tools shows the same picture with less fuss. Treat h2 as the baseline and h3 as a bonus when the path allows it.
When middleboxes hide HTTP/3
Many corporate networks filter or mishandle UDP. On those paths you will never see HTTP/3, even though the origin supports it. The same site can show h3 on a phone over LTE and h2 from the office Wi‑Fi. Trust the path you are testing, not a blog post that says every visitor must advertise h3. Fallback to HTTP/2 is the design working as intended.
If AutoSSL stopped after you tightened firewall rules, reopen port 80 and wait for the next run. If only one network cannot see HTTP/3, the issue is almost always UDP filtering on that path. QUIC already includes TLS 1.3, so there is no cleartext HTTP/3. Devices that inspect TLS on TCP 443 often cannot inspect QUIC and simply drop UDP instead. Home networks, phones, and most data-center checks will negotiate whatever the client can use.
What you should actually check
Confirm HTTPS works over HTTP/2 before you worry about HTTP/3. Keep ports 80 and 443/tcp open, and allow 443/udp if you control the firewall in front of a VPS or dedicated server. On shared hosting you do not manage those listeners yourself; LiteSpeed handles the protocol side. Measure from more than one network if results disagree, and open a ticket only when HTTP/2 or certificates fail—not when a single office never shows h3.
Tagged
Was this article helpful?
Be the first to rate this article.
