<?xml version="1.0" encoding="UTF-8"?><rss xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:content="http://purl.org/rss/1.0/modules/content/" xmlns:atom="http://www.w3.org/2005/Atom" version="2.0" xmlns:media="http://search.yahoo.com/mrss/"><channel><title><![CDATA[http/2 - Shodan Blog]]></title><description><![CDATA[The latest news and developments for Shodan.]]></description><link>https://blog.shodan.io/</link><generator>Ghost 0.7</generator><lastBuildDate>Sun, 12 Apr 2026 02:19:54 GMT</lastBuildDate><atom:link href="https://blog.shodan.io/tag/http2/rss/" rel="self" type="application/rss+xml"/><ttl>60</ttl><item><title><![CDATA[Tracking HTTP/2.0 Adoption]]></title><description><![CDATA[<p>HTTP/2.0 is the next version of the protocol powering websites and it promises <a href="https://http2.github.io/faq/#what-are-the-key-differences-to-http1x">many improvements</a> over HTTP/1.x. There are a few different ways that a server can advertise support for HTTP/2.0 but the most common one is during the SSL handshake. I've added support</p>]]></description><link>https://blog.shodan.io/tracking-http2-0-adoption/</link><guid isPermaLink="false">5ec4b674-87e6-4258-b0e3-7f182b93ecb1</guid><category><![CDATA[research]]></category><category><![CDATA[http/2]]></category><category><![CDATA[spdy]]></category><dc:creator><![CDATA[John Matherly]]></dc:creator><pubDate>Sun, 13 Dec 2015 05:40:33 GMT</pubDate><media:content url="http://blog.shodan.io/content/images/2015/12/Firefox_Screenshot_2015-12-13T05-40-01-999Z.png" medium="image"/><content:encoded><![CDATA[<img src="http://blog.shodan.io/content/images/2015/12/Firefox_Screenshot_2015-12-13T05-40-01-999Z.png" alt="Tracking HTTP/2.0 Adoption"><p>HTTP/2.0 is the next version of the protocol powering websites and it promises <a href="https://http2.github.io/faq/#what-are-the-key-differences-to-http1x">many improvements</a> over HTTP/1.x. There are a few different ways that a server can advertise support for HTTP/2.0 but the most common one is during the SSL handshake. I've added support in Shodan for tracking the negotiated HTTP versions and the data can be searched using the <a href="https://www.shodan.io/search?query=ssl.alpn%3Ah2"><strong>ssl.alpn</strong></a> filter.</p>

<p>Without further ado, here are the <a href="https://www.shodan.io/report/mNs9fa3I">most popular HTTP versions</a> on the Internet for HTTPS servers (port 443):</p>

<p><img src="https://blog.shodan.io/content/images/2015/12/Firefox_Screenshot_2015-12-13T02-22-26-532Z.png" alt="Tracking HTTP/2.0 Adoption"></p>

<p>The above chart was generated using Shodan Reports, which now automatically show a summary of the negotiated HTTP versions when possible. Here are the top 10 versions in text:</p>

<ol>
<li><strong>HTTP/1.1</strong>  </li>
<li>SPDY/3.1  </li>
<li>SPDY/2  </li>
<li>SPDY/3  </li>
<li><strong>HTTP/2</strong>  </li>
<li>HTTP/2 Draft 14  </li>
<li><strong>HTTP/2 (Cleartext)</strong>  </li>
<li>HTTP/2 Draft 17  </li>
<li>HTTP/1.0  </li>
<li>SPDY/0.9.4</li>
</ol>

<p>Unsurprisingly, HTTP/1.1 remains the most popular version and I'd expect it to stay that way for a while. <strong>SPDY</strong> also remains a fairly popular choice, mostly due to CloudFlare's support:</p>

<p><img src="https://blog.shodan.io/content/images/2015/12/Firefox_Screenshot_2015-12-13T03-02-34-222Z.png" alt="Tracking HTTP/2.0 Adoption"></p>

<p>Taking a <a href="https://www.shodan.io/report/iLzUWHyz">deeper look at the HTTP/2 results</a> we can see that the following organizations are leading the charge in <strong>HTTP/2 support</strong>:</p>

<p><img src="https://blog.shodan.io/content/images/2015/12/Firefox_Screenshot_2015-12-13T02-29-08-132Z.png" alt="Tracking HTTP/2.0 Adoption"></p>

<p><a href="https://www.singlehop.com">Singlehop</a> has the most servers supporting HTTP/2.0 at the moment! The 2nd organization "GetClouder EOOD" is actually <a href="https://www.siteground.com/">SiteGround</a> followed by Hostwinds and Cloudflare.</p>

<p>Some general oddities in the data:</p>

<ol>
<li>There are a few servers that support HTTP/2 and <strong>SSLv2</strong>: <a href="https://www.shodan.io/search?query=ssl.alpn%3Ah2+ssl.version%3Asslv2">https://www.shodan.io/search?query=ssl.alpn%3Ah2+ssl.version%3Asslv2</a>  </li>
<li>Google is the only provider of TLS with IMAP, POP3 and SMTP that also supports HTTP/2: <a href="https://www.shodan.io/search?query=ssl.alpn%3Ah2+port%3A%22993%22">https://www.shodan.io/search?query=ssl.alpn%3Ah2+port%3A%22993%22</a></li>
</ol>

<p>You can get a full breakdown of all the organizations and versions using the <a href="https://cli.shodan.io">Shodan command-line</a>. Here's a video that shows how to do a few things which can be run automatically every month to keep track of changes in HTTP/2 adoption:</p>

<script type="text/javascript" src="https://asciinema.org/a/31715.js" id="asciicast-31715" async></script>

<p>TL;DR: ~115,000 web servers on the Internet support HTTP/2 as of December 2015.</p>]]></content:encoded></item></channel></rss>