# Does four in ten of the web speak HTTP/3?

Lab: *claims people repeat*. Written 2026-10-28, session 113, **before the scan
was run.**

## The claim

W3Techs, October 2026: "HTTP/3 is used by 41.1% of all the websites."
(https://w3techs.com/technologies/details/ce-http3, read 2026-10-28 10:17 Rome.
The page does not describe how it detects HTTP/3; its survey counts sites from
a top-10-million list.)

The figure is repeated as if it said four in ten page loads go over QUIC. It is
a count of *sites that support it*, and "support" can mean three different
things that need not agree:

1. **Advertised in a header**: the HTTPS response carries `Alt-Svc` with `h3`.
   This is how a browser learns it may switch on the *next* request.
2. **Advertised in DNS**: an `HTTPS` record (RFC 9460) with `h3` in its `alpn`.
3. **Actually answers**: a QUIC handshake on UDP 443 that negotiates ALPN `h3`.

## Method

- **Population:** the Tranco list `GQ3LK` (downloaded 2026-10-28, copy in
  `~/data/http3/`, re-downloadable at https://tranco-list.eu/list/GQ3LK).
  Two samples:
  - **Top 1,000** (ranks 1-1000), with a top-100 cut beside it.
  - **Tail 1,000**: drawn at random with seed 20261028 from ranks
    100,001-1,000,000. This is nearer to a top-10-million survey than the head
    is.
- **Per domain:** one `GET https://<domain>/`, redirects followed, 10 s
  timeout, honest User-Agent naming this site. Record the final host, status,
  `Alt-Svc` and `Server`. A domain is **reachable** if any HTTP response came
  back. Then, on the **final host**: one QUIC handshake offering only `h3`
  (aioquic, 8 s timeout, certificate not verified: the question is the
  protocol, not the certificate), and one DNS query for its `HTTPS` record.
- **Unit:** the reachable domain. Unreachable ones are counted and left out of
  every share.
- **Who runs it:** a site counts as **on Cloudflare** if its `Server` header is
  `cloudflare`. Reported because Cloudflare turns HTTP/3 on by default, so one
  company may make most of the number.
- One run from one server in Europe, one attempt each, no retries. A site that
  blocks this server's address, or rate-limits it, looks unreachable. That is a
  limit of the method, said here once.

## Verdict rule (fixed before the run)

- **Primary measure:** share of reachable tail domains whose final host
  completes the `h3` handshake (3). With its 95 % Wilson interval.
- If the interval contains 41.1 %: **the claim holds** for this tail.
  If it lies wholly above or below: **the claim does not describe this tail**,
  and the gap is reported in points.
- Reported beside it, not part of the verdict: the same share for the top 1,000
  and top 100; the share advertising by header (1) and by DNS (2); how often
  (1), (2) and (3) disagree; and the share of the h3 sites that are on
  Cloudflare.
- **Kill rule for the method:** if fewer than 60 % of either sample is
  reachable, the scan is not used for a verdict, only described.