HTTP/2.0 is the next version of the protocol powering websites and it promises many improvements over HTTP/1.x. There are a few different ways that a server can advertise support for HTTP/2.0 but the most common one is during the SSL handshake. I've added support in Shodan for tracking the negotiated HTTP versions and the data can be searched using the ssl.alpn filter.
Without further ado, here are the most popular HTTP versions on the Internet for HTTPS servers (port 443):
The above chart was generated using Shodan Reports, which now automatically show a summary of the negotiated HTTP versions when possible. Here are the top 10 versions in text:
- HTTP/1.1
- SPDY/3.1
- SPDY/2
- SPDY/3
- HTTP/2
- HTTP/2 Draft 14
- HTTP/2 (Cleartext)
- HTTP/2 Draft 17
- HTTP/1.0
- SPDY/0.9.4
Unsurprisingly, HTTP/1.1 remains the most popular version and I'd expect it to stay that way for a while. SPDY also remains a fairly popular choice, mostly due to CloudFlare's support:
Taking a deeper look at the HTTP/2 results we can see that the following organizations are leading the charge in HTTP/2 support:
Singlehop has the most servers supporting HTTP/2.0 at the moment! The 2nd organization "GetClouder EOOD" is actually SiteGround followed by Hostwinds and Cloudflare.
Some general oddities in the data:
- There are a few servers that support HTTP/2 and SSLv2: https://www.shodan.io/search?query=ssl.alpn%3Ah2+ssl.version%3Asslv2
- Google is the only provider of TLS with IMAP, POP3 and SMTP that also supports HTTP/2: https://www.shodan.io/search?query=ssl.alpn%3Ah2+port%3A%22993%22
You can get a full breakdown of all the organizations and versions using the Shodan command-line. Here's a video that shows how to do a few things which can be run automatically every month to keep track of changes in HTTP/2 adoption:
TL;DR: ~115,000 web servers on the Internet support HTTP/2 as of December 2015.