惯性聚合 高效追踪和阅读你感兴趣的博客、新闻、科技资讯
阅读原文 在惯性聚合中打开

推荐订阅源

爱范儿
爱范儿
E
Exploit-DB.com RSS Feed
Google DeepMind News
Google DeepMind News
F
Full Disclosure
D
Darknet – Hacking Tools, Hacker News & Cyber Security
T
ThreatConnect
Stack Overflow Blog
Stack Overflow Blog
Last Week in AI
Last Week in AI
Martin Fowler
Martin Fowler
G
GRAHAM CLULEY
C
Check Point Blog
T
Threatpost
I
Intezer
Spread Privacy
Spread Privacy
The Register - Security
The Register - Security
Project Zero
Project Zero
月光博客
月光博客
人人都是产品经理
人人都是产品经理
阮一峰的网络日志
阮一峰的网络日志
D
DataBreaches.Net
IT之家
IT之家
Malwarebytes
Malwarebytes
T
The Blog of Author Tim Ferriss
P
Privacy International News Feed
P
Palo Alto Networks Blog
T
The Exploit Database - CXSecurity.com
量子位
李成银的技术随笔
Threat Intelligence Blog | Flashpoint
Threat Intelligence Blog | Flashpoint
Cisco Talos Blog
Cisco Talos Blog
Know Your Adversary
Know Your Adversary
美团技术团队
The GitHub Blog
The GitHub Blog
T
Tor Project blog
M
MIT News - Artificial intelligence
奇客Solidot–传递最新科技情报
奇客Solidot–传递最新科技情报
Google Online Security Blog
Google Online Security Blog
P
Proofpoint News Feed
有赞技术团队
有赞技术团队
让小产品的独立变现更简单 - ezindie.com
让小产品的独立变现更简单 - ezindie.com
博客园 - 司徒正美
OSCHINA 社区最新新闻
OSCHINA 社区最新新闻
C
Comments on: Blog
T
Threat Research - Cisco Blogs
aimingoo的专栏
aimingoo的专栏
Security Latest
Security Latest
NISL@THU
NISL@THU
The Cloudflare Blog
H
Help Net Security
Recent Commits to openclaw:main
Recent Commits to openclaw:main

The Cloudflare Blog

The day my ping took countermeasures Announcing Claude Compliance API support with Cloudflare CASB Announcing Claude Managed Agents on Cloudflare Project Glasswing: what Mythos showed us Our billing pipeline was suddenly slow. The culprit was a hidden bottleneck in ClickHouse Browser Run: now running on Cloudflare Containers, it’s faster and more scalable When "idle" isn't idle: how a Linux kernel optimization became a QUIC bug Building For The Future How Cloudflare responded to the “Copy Fail” Linux vulnerability When DNSSEC goes wrong: how we responded to the .de TLD outage Code Orange: Fail Small is complete. The result is a stronger Cloudflare network Introducing Dynamic Workflows: durable execution that follows the tenant Post-quantum encryption for Cloudflare IPsec is generally available Agents can now create Cloudflare accounts, buy domains, and deploy Shutdowns, power outages, and conflict: a review of Q1 2026 Internet disruptions Making Rust Workers reliable: panic and abort recovery in wasm‑bindgen Moving past bots vs. humans Building the agentic cloud: everything we launched during Agents Week 2026 The AI engineering stack we built internally — on the platform we ship Orchestrating AI Code Review at scale Introducing the Agent Readiness score. Check to see if your site is agent-ready Shared Dictionaries: compression that keeps up with the agentic web Redirects for AI Training enforces canonical content Unweight: how we compressed an LLM 22% without sacrificing quality Agents that remember: introducing Agent Memory Agents Week: network performance update Introducing Flagship: feature flags built for the age of AI Cloudflare’s AI Platform: an inference layer designed for agents Building the foundation for running extra-large language models AI Search: the search primitive for your agents Deploy Postgres and MySQL databases with PlanetScale + Workers Artifacts: versioned storage that speaks Git Email for agents - Cloudflare Email Service now in public beta Project Think: building the next generation of AI agents on Cloudflare Introducing Agent Lee - a new interface to the Cloudflare stack Register domains wherever you build: Cloudflare Registrar API now in beta Browser Run: give your agents a browser Rearchitecting the Workflows control plane for the agentic era Add voice to your agent Managed OAuth for Access: make internal apps agent-ready in one click Securing non-human identities: automated revocation, OAuth, and scoped permissions Scaling MCP adoption: Our reference architecture for simpler, safer and cheaper enterprise deployments of MCP Secure private networking for everyone: users, nodes, agents, Workers — introducing Cloudflare Mesh Building a CLI for all of Cloudflare Durable Objects in Dynamic Workers: Give each AI-generated app its own database Agents have their own computers with Sandboxes GA Dynamic, identity-aware, and secure Sandbox auth Welcome to Agents Week 500 Tbps of capacity: 16 years of scaling our global network From bytecode to bytes- automated magic packet generation Cloudflare targets 2029 for full post-quantum security How we built Organizations to help enterprises manage Cloudflare at scale Why we're rethinking cache for the AI era Our ongoing commitment to privacy for the 1.1.1.1 public DNS resolver Introducing EmDash — the spiritual successor to WordPress that solves plugin security Introducing Programmable Flow Protection: custom DDoS mitigation logic for Magic Transit customers Cloudflare Client-Side Security: smarter detection, now open to everyone How we use Abstract Syntax Trees (ASTs) to turn Workflows code into visual diagrams A one-line Kubernetes fix that saved 600 hours a year Sandboxing AI agents, 100x faster Inside Gen 13- how we built our most powerful server yet Launching Cloudflare’s Gen 13 servers- trading cache for cores for 2x edge compute performance Powering the agents: Workers AI now runs large models, starting with Kimi K2.5 Introducing Custom Regions for precision data control Standing up for the open Internet- why we appealed Italy’s Piracy Shield fine From legacy architecture to Cloudflare One Announcing Cloudflare Account Abuse Protection: prevent fraudulent attacks from bots and humans Slashing agent token costs by 98% with RFC 9457-compliant error responses AI Security for Apps is now generally available Building a security overview dashboard for actionable insights Investigating multi-vector attacks in Log Explorer Translating risk insights into actionable protection: leveling up security posture with Cloudflare and Mastercard Fixing request smuggling vulnerabilities in Pingora OSS deployments Active defense: introducing a stateful vulnerability scanner for APIs Complexity is a choice. SASE migrations shouldn’t take years. From the endpoint to the prompt: a unified data security vision in Cloudflare One Ending the "silent drop": how Dynamic Path MTU Discovery makes the Cloudflare One Client more resilient A QUICker SASE client: re-building Proxy Mode How Automatic Return Routing solves IP overlap Always-on detections: eliminating the WAF “log versus block” trade-off Mind the gap: new tools for continuous enforcement from boot to login Stop reacting to breaches and start preventing them with User Risk Scoring Defeating the deepfake: stopping laptop farms and insider threats Moving from license plates to badges: the Gateway Authorization Proxy Evolving Cloudflare’s Threat Intelligence Platform: actionable, scalable, and ETL-less Introducing the 2026 Cloudflare Threat Report See risk, fix risk: introducing Remediation in Cloudflare CASB How Cloudy translates complex security into human action From reactive to proactive: closing the phishing gap with LLMs Modernizing with agile SASE: a Cloudflare One blog takeover Beyond the blank slate: how Cloudflare accelerates your Zero Trust journey The truly programmable SASE platform Toxic combinations: when small signals add up to a security incident We deserve a better streams API for JavaScript The most-seen UI on the Internet? Redesigning Turnstile and Challenge Pages ASPA: making Internet routing more secure Bringing more transparency to post-quantum usage, encrypted messaging, and routing security How we rebuilt Next.js with AI in one week Cloudflare One is the first SASE offering modern post-quantum encryption across the full platform Cloudflare outage on February 20, 2026
CloudFlare’s Impact On The HTTP/2 “Universe”
Cloudflare Team · 2016-02-04 · via The Cloudflare Blog

CloudFlare’s Impact On The HTTP/2 “Universe”

2016-02-03

4 min read

CloudFlare released HTTP/2 support for all customers on December 3rd, 2015. Now, two months later, it's time to take a look at the impact of this release on the HTTP/2 "universe" and also at what has changed from a HTTP/2 vs. SPDY vs. HTTP 1.1 traffic ratio perspective.

HTTP/2 Usage

Previously, we showcased browser market share data from our own website. Using these numbers, we predicted the ratio of HTTP/2 traffic that we expected to see once enabled. Now, we can compare this original data set with updated data from the last 48 hours.

Below is the market share of HTTP/2 capable browsers that we saw on our website during a 48-hour period. The first one was before our HTTP/2 launch, the other one was last week. Both data sets were pulled from Google Analytics, and user agents were analyzed for HTTP/2 support.

HTTP/2 capable browser

Global Market Share (Late Nov 2015)

Global Market Share (Late Jan 2016)

IE 11 on Windows 10

0.14%

0.34%

Edge 12, and 13

0.35%

0.48%

Firefox 36 - 45

5.09%

11.05%

Chrome 41 - 49

15.06%

38.86%

Safari 9

0.91%

2.69%

Opera 28 - 34

0.57%

0.78%

Safari for iOS 9.1

1.07%

0.94%

Opera 30 for Android

0.01%

0.00%

Chrome 46 - 48 for Android

3.59%

1.60%

Firefox 41 - 44 for Android

0.01%

0.00%

Total

26.79%

56.74%

Since November, the number of browsers visiting CloudFlare.com that support HTTP/2 has more than doubled. In particular, notice how the market share of Chrome and Firefox versions that support HTTP/2 increased dramatically within the last 2 months.

The reason for this is, that even with Auto-Update functionality in modern browsers, new versions are not adopted instantaneous. We had documented the release of iOS 9, which is an example for a quite swift adoption. Looking at the challenges around the SHA-1 deprecation, we can see that some ancient OS and browser version are still around.

Keep in mind that we still see a larger number of non-browsers that don’t fall into any of the above buckets on our edge network. This is due to bots, crawlers, scrapers, and the like. The numbers above represent typical website traffic after it has been sanitized by CloudFlare.

Real-Life Numbers

With the promising browser market share data above, we can now compare the ratio of traffic served via the different HTTP versions on www.cloudflare.com.

Again, contrast the data from around our release in December to the current data.

Protocol Version

Percentage of Hits December 2015

Percentage of Hits February 2016

HTTP/1.x

19.36%

17.29%

SPDY/3.1

57.02%

29.79%

HTTP/2

23.62%

52.93%

The great news: the HTTP/2 traffic ratio has indeed more than doubled on www.cloudflare.com since we rolled out HTTP/2.

Nevertheless, we are still serving a large portion of traffic over SPDY, mostly due to older versions of Chrome. Therefore, it was a good choice to keep supporting this protocol version.

Number of HTTP/2-Powered Websites

So far, we have looked at what an individual HTTP/2 enabled site on CloudFlare could expect to see with regard to traffic and different browser versions. Let’s shift gears a bit and have a look at how many websites we have actually enabled with HTTP/2 so far:

The website isthewebhttp2yet.com is a great tool for finding an answer to this question. It is created and maintained by researchers at Telefónica Research, Case Western Reserve University, and Carnegie Mellon University, and provides an overview of how many websites from the Alexa 1M list are enabled with HTTP/2.

The website differentiates between:

  • Announced Support: Sites indicate which application-layer protocols they support using NPN/ALPN. If a site indicates HTTP/2, it is considered as "Announced Support."

  • Partial Support: Some sites that announce HTTP/2 support, but immediately downgrade the connection to HTTP 1.1 if a client makes a request using HTTP/2. If a site responds using HTTP/2, even just to return an error page or redirect, this is classified as partial support.

  • True Support: If a site actually serves page content using HTTP/2, even if some embedded objects are still served over HTTP 1.1, this is called true support.

In this post, we will only focus on websites with "True Support"—since that’s what you get with CloudFlare—and will ignore the other two metrics.

Looking at the HTTP/2 adoption curve for the Alexa 1 million shows quite an interesting picture:

graph of http/2 support over time

Source

You can see a sharp increase of domains with "True Support" in December 2015, bringing the number of domains with “True Support” from 14,017 (December 1st, 2015) to 75,288 (December 31st, 2015).

According to isthewebhttp2yet.com, 58,591 of these domains run through CloudFlare. That means CloudFlare more than quadrupled the number of HTTP/2 sites with the December 2015 release.

We’d like to give a big shout-out to the team of isthewebhttp2yet.com. They worked with our engineers to update their measurement method to include the Server Name Indication (SNI) TLS extension when they probe sites for HTTP/2 support. By doing so, the site is able to identify all CloudFlare-powered sites. You can see this measurement change kicking in within the above graph at the sharp increase from 24,947 domains to 74,271 domains.

HTTP/2 Market Position

Another website measuring the adoption of HTTP/2 on the server side is W3 Techs. While the graph generated by W3 Techs for HTTP/2 adoption is much more coarse grained on the time axis, the increase of HTTP/2 enabled websites due to CloudFlare is nevertheless clearly visible.

graph of http/2 traffic over time (coarse)

Source

With our wide support of HTTP/2 for all CloudFlare customers, we have also helped to improve the market position—with regard to popularity and traffic—of HTTP/2 close to that of SPDY.

HTTP/2 vs SPDY market share

Source

Want to help us grow our software engineering team and increase our protocol support? Check out our available roles.

Enabling HTTP/2

As a reminder, if you are a customer on the Free or Pro plan, there is no need to do anything at all. Both SPDY and HTTP/2 are already enabled for you. With this improvement, your website’s audience will always use the fastest protocol version when accessing your site over TLS/SSL.

Customers on Business and Enterprise plans can enable HTTP/2 within the "Network" application of the CloudFlare Dashboard. In the last two months, the web still hasn't exploded while running HTTP/2. With that in mind, it's probably safe for you to head over an enabled HTTP/2 now. You will be in great company with many other sites.

enabling HTTP/2 in the CloudFlare dashboard

If you are not yet a customer of CloudFlare, sign up now, and you’ll be able to leverage HTTP/2 within a few minutes.

Stay tuned for more additions to our HTTP/2 capabilities!

HTTP2spdySpeed & Reliability