Alt-Svc: advertising an alternative endpoint
Alt-Svc tells a client that the same resources are available over a different protocol or endpoint, which is the usual way a site advertises HTTP/3 support.
At a glance
- Direction
- Response only.
- Defined in
- RFC 7838
- When absent
- The client keeps using the protocol and endpoint it already connected on.
- Value
- A protocol identifier and authority, for example h3=":443"
- ma
- Max age in seconds: how long the client may remember the alternative
- persist=1
- Asks the client to keep the entry across network changes
- Alternative mechanism
- An HTTPS record in DNS, which avoids the first connection on the old protocol.
In detail
An alternative service is the same origin reached a different way. The security context does not change, so cookies, storage and origin checks all behave exactly as before; only the transport differs. That is what makes it safe for a browser to quietly move to the advertised endpoint without telling anyone.
The dominant use is HTTP/3. A site cannot begin on HTTP/3, because the first connection is made over TCP before anything is known about the server, so it answers over HTTP/2 and advertises h3 in this header. The next connection uses the newer protocol, which is why the switch shows up on a second page view rather than the first.
The ma parameter sets how long the client may remember the entry, and persist asks it to survive a network change such as moving between wireless networks. Both are hints. A client may forget an alternative at any time and fall back to the original endpoint, so the original must keep working.
The remaining round trip is what DNS records solve. Publishing an HTTPS record lets a client learn about HTTP/3 support before it connects at all, which removes the first connection on the older protocol entirely. The header remains the fallback for clients that do not query for that record.
Examples
Alt-Svc: h3=":443"; ma=86400Alt-Svc: h3=":443"; ma=86400, h2="alt.example.com:443"; ma=3600; persist=1curl -sI https://example.com | grep -i alt-svcThings that catch people out
- Advertising an alternative that is not actually reachable costs every client a failed connection attempt before it falls back.
- The switch does not happen on the response carrying the header, so testing with a single request will never show the new protocol in use.
- A long ma value keeps clients pointed at an endpoint you may want to retire, so lower it well before you turn anything off.
Try it: HTTP Headers Checker
Check a live URL or paste headers you already have. It grades six security headers from A+ to F and lists every other header the response returned.
HTTP Headers Checker
LOCAL · Browser-OnlyView HTTP response headers for any URL
Enter any website URL to fetch and analyze its HTTP response headers. We'll automatically add https:// if needed.
Why Check Security Headers?
Security headers protect your website against common attacks like XSS, clickjacking, and MIME sniffing. They're set by your web server and cost nothing to implement. Missing security headers are one of the most common findings in security audits.
Related HTTP headers
All http headers →Connection: keep-alive, close and hop by hop headers
What the Connection header controls, how it lists hop by hop headers, why HTTP/1.1 keeps connections open by default, and why HTTP/2 forbids it.
Upgrade: switching protocols on an open connection
How the Upgrade header negotiates a protocol switch, what a 101 response means, why proxies break WebSocket handshakes, and what HTTP/2 does instead.
Server: what software answered the request
What the Server header conveys, why exposing a version number helps attackers narrow their targets, and what to put there instead of removing it entirely.
Link: relationships expressed in a header
How the Link header carries relationships that markup cannot, its use for preload with early hints, and the pagination pattern that APIs build on it.
Server-Timing: server side metrics in the response
How to report server side durations to the browser, the dur and desc parameters, what it costs to expose them, and how to read them cross-origin.
Early-Data: requests sent before the handshake finished
What TLS early data is, why a request sent in it can be replayed, what the Early-Data header signals, and when a server should answer 425 Too Early.
Tools for this
- HTTP Headers Checker Free online HTTP headers checker - view HTTP response headers for any URL
- HTTP Request Builder Free online HTTP request builder - build and test HTTP requests with custom headers and body