Title: WordPress and HTTP/2 Author: Zack Tollman Published: September 8, 2015 Last modified: September 9, 2015 --- [ ](https://profiles.wordpress.org/tollmanz/) [Zack Tollman](https://profiles.wordpress.org/tollmanz/) 12:50 am _on_ September 8, 2015 Tags: [agenda ( 1,149 )](https://make.wordpress.org/core/tag/agenda/), HTTP/2, [HTTPS ( 6 )](https://make.wordpress.org/core/tag/https/)    # WordPress and HTTP/2 HTTPHTTP HTTP is an acronym for Hyper Text Transfer Protocol. HTTP is the underlying protocol used by the World Wide Web and this protocol defines how messages are formatted and transmitted, and what actions Web servers and browsers should take in response to various commands./2 was [finalized](https://httpwg.github.io/specs/rfc7540.html) by the IETF earlier this year. This update to the HTTP protocol is the first major update in 16 years, since HTTP/1.1 was adopted in 1999. HTTP/2 promises faster websites by reducing latency through various innovations. Additionally, all major browser vendors have announced intentions to support HTTP/2 over TLS/SSLSSL Secure Sockets Layer. Provides a secure means of sending data over the internet. Used for authenticated and private actions. only, meaning that HTTP/2 brings with it an era of HTTPSHTTPS HTTPS is an acronym for Hyper Text Transfer Protocol Secure. HTTPS is the secure version of HTTP, the protocol over which data is sent between your browser and the website that you are connected to. The 'S' at the end of HTTPS stands for 'Secure'. It means all communications between your browser and the website are encrypted. This is especially helpful for protecting sensitive data like banking information. only websites. For a deeper dive into HTTP/2, highly recommend [the chapter on HTTP/2](http://chimera.labs.oreilly.com/books/1230000000545/ch12.html) in _High Performance Browser Networking_. For the WordPress 4.4 release cycle, Scott Taylor has asked Eric Andrew Lewis and I to investigate what, if anything, WordPress can do to make HTTP/2 integration seamless. We want to get this discussion started with some initial thoughts and an invitation to brainstorm in a dev chat next week. HTTP/2 has been developed to _just work_ with existing websites, suggesting that there is nothing in particular that we need to do to make WordPress compatible with HTTP/2; however, for all intents and purposes, HTTPS is required for HTTP/2 to work in browsers. One area of focus for making it easier to deployDeploy Launching code from a local development environment to the production web server, so that it's available to visitors. WordPress with HTTP/2 is to focus on tickets related to TLS/ SSL issues. John Blackbourn has graciously compiled a list of tickets that could use attention: * [https://core.trac.wordpress.org/ticket/12400](https://core.trac.wordpress.org/ticket/12400) * [https://core.trac.wordpress.org/ticket/14172](https://core.trac.wordpress.org/ticket/14172) * [https://core.trac.wordpress.org/ticket/14867](https://core.trac.wordpress.org/ticket/14867) * [https://core.trac.wordpress.org/ticket/25449](https://core.trac.wordpress.org/ticket/25449) * [https://core.trac.wordpress.org/ticket/27954](https://core.trac.wordpress.org/ticket/27954) * [https://core.trac.wordpress.org/ticket/28424](https://core.trac.wordpress.org/ticket/28424) * [https://core.trac.wordpress.org/ticket/28507](https://core.trac.wordpress.org/ticket/28507) * [https://core.trac.wordpress.org/ticket/28520](https://core.trac.wordpress.org/ticket/28520) * [https://core.trac.wordpress.org/ticket/28521](https://core.trac.wordpress.org/ticket/28521) * [https://core.trac.wordpress.org/ticket/31405](https://core.trac.wordpress.org/ticket/31405) * [https://core.trac.wordpress.org/ticket/31495](https://core.trac.wordpress.org/ticket/31495) * [https://core.trac.wordpress.org/ticket/33546](https://core.trac.wordpress.org/ticket/33546) * [https://core.trac.wordpress.org/ticket/33547](https://core.trac.wordpress.org/ticket/33547) * [https://core.trac.wordpress.org/ticket/33620](https://core.trac.wordpress.org/ticket/33620) * [https://core.trac.wordpress.org/ticket/33621](https://core.trac.wordpress.org/ticket/33621) In addition to focusing on these tickets, Eric and I have started working on more documentation for setting up TLS/SSL for WordPress, which will naturally lend itself to guides on HTTP/2 deployments for WordPress. As for HTTP/2 and WordPress, we fortunately do not need to anything to make it work and existing web apps are already compatible. If we chose to, we can try to optimize WordPress for HTTP/2. These optimizations could manifest as optional theme support for HTTP/2 (i.e., add_theme_support() value) or using a constant to unlock HTTP/ 2 optimizations. We could add support for critical rendering path CSSCSS Cascading Style Sheets. that would allow WordPress to use server push to quickly deliver the assets to the browser. Additionally, we could consider building default themes with non-concatenated JSJS JavaScript, a web scripting language typically executed in the browser. Often used for advanced user interfaces and behaviors. files to optimize delivery for HTTP/2 (we’d still ship the concatenated version for HTTP/1.1 deployments). These are merely early thoughts on what we might be able to do and we are hoping to gather feedback and ideas here and during the dev chat. For those interested, Eric and I set up a test bed for HTTP/2 and WordPress. We have two sites set up, one with [HTTP/1.1](http://http11.wphttp.com/) and one with [HTTP/2](https://http2.wphttp.com/). Currently, they are running the exact same code base (with Twenty Sixteen!) and only differ in the protocol that is used. We intend to experiment with ideas on this setup. The repo is on [Github](https://github.com/tollmanz/wphttp) and we plan to make more setup information available soon. To kick things off, we will have a meeting on [September 10 at 20:00 UTC](https://www.timeanddate.com/worldclock/fixedtime.html?iso=20150910T2000) in the [#core](https://make.wordpress.org/core/tag/core/) room on [slack](https://make.wordpress.org/chat/). [#agenda](https://make.wordpress.org/core/tag/agenda/), [#http2](https://make.wordpress.org/core/tag/http2/), [#https](https://make.wordpress.org/core/tag/https/) ### Share this: * [ Threads ](https://make.wordpress.org/core/2015/09/08/wordpress-and-http2/?share=threads) * [ Mastodon ](https://make.wordpress.org/core/2015/09/08/wordpress-and-http2/?share=mastodon) * [ Bluesky ](https://make.wordpress.org/core/2015/09/08/wordpress-and-http2/?share=bluesky) * [ X ](https://make.wordpress.org/core/2015/09/08/wordpress-and-http2/?share=x) * [ Facebook ](https://make.wordpress.org/core/2015/09/08/wordpress-and-http2/?share=facebook) * [ LinkedIn ](https://make.wordpress.org/core/2015/09/08/wordpress-and-http2/?share=linkedin) 1. ![](https://secure.gravatar.com/avatar/6dba66de73d09f673806e6301e633651cc0814a75ce87341b5798f81e7bc5bce? s=32&d=mm&r=g) 2. [Ionel Roiban](https://profiles.wordpress.org/wpdeveloper/) 4:38 pm _on_ September 8, 2015 3. Was about time to start talking about it, since wordpress.comWordPress.com An online implementation of WordPress code that lets you immediately access a new WordPress environment to publish your content. WordPress.com is a private company owned by Automattic that hosts the largest multisite in the world. This is arguably the best place to start blogging if you have never touched WordPress before. [https://wordpress.com/](https://wordpress.com/) already supports SPDY: [https://spdycheck.org/#wordpress.com](https://spdycheck.org/#wordpress.com) 4. * ![](https://secure.gravatar.com/avatar/9c0affc8ad4a25431f48a8563264a089650f6332b868bd0e7c999f72741967ed? s=32&d=mm&r=g) * [chriscct7](https://profiles.wordpress.org/chriscct7/) 4:41 pm _on_ September 8, 2015 * On a related note: SPDY is being removed from Chrome early next year: [http://blog.chromium.org/2015/02/hello-http2-goodbye-spdy-http-is_9.html](http://blog.chromium.org/2015/02/hello-http2-goodbye-spdy-http-is_9.html) * ![](https://secure.gravatar.com/avatar/b5f16acb1bc24ca6bf644adb593384de64046fa69c5de867a7647c7f736a1271? s=32&d=mm&r=g) * [Alex Mills (Viper007Bond)](https://profiles.wordpress.org/viper007bond/) 12:22 am _on_ September 9, 2015 * Supported it for over 3 years infact: [https://barry.wordpress.com/2012/06/16/nginx-spdy-and-automattic/](https://barry.wordpress.com/2012/06/16/nginx-spdy-and-automattic/) * But as [@chriscct7](https://profiles.wordpress.org/chriscct7/) mentions, HTTPHTTP HTTP is an acronym for Hyper Text Transfer Protocol. HTTP is the underlying protocol used by the World Wide Web and this protocol defines how messages are formatted and transmitted, and what actions Web servers and browsers should take in response to various commands./2 replaces SPDY. 5. ![](https://secure.gravatar.com/avatar/9639e64581b61a017700cdc0d02ac17b4b1124a137afc5263d7b699de7cfe3e1? s=32&d=mm&r=g) 6. [Tim Nash](https://profiles.wordpress.org/tnash/) 4:43 pm _on_ September 8, 2015 7. (puts hand up) to volunteer on helping plough through issues, will also try to make the dev meeting on Thursday though need to juggle a few things around. 8. * ![](https://secure.gravatar.com/avatar/1a30c2f9646fb18d064586833015e2b9b44d79d3933d0cb12a8f12fdc6238f79? s=32&d=mm&r=g) * [Zack Tollman](https://profiles.wordpress.org/tollmanz/) 4:47 pm _on_ September 8, 2015 * Will be great to have your experience in these conversations! 9. ![](https://secure.gravatar.com/avatar/798abd55625edec6912b3ffe68995b84ffddb0952f7f761ff5467894ca7602c1? s=32&d=mm&r=g) 10. [99robots](https://profiles.wordpress.org/99robots/) 5:08 pm _on_ September 8, 2015 11. This sounds great 🙂 Having every WordPress site on SSLSSL Secure Sockets Layer. Provides a secure means of sending data over the internet. Used for authenticated and private actions. eventually is a big plus. 12. ![](https://secure.gravatar.com/avatar/3ffa91fa19c2cdc838e5caf8c50a54516aeba692355ae27d26db4389abddb70c? s=32&d=mm&r=g) 13. [avcascade](https://profiles.wordpress.org/avcascade/) 6:47 pm _on_ September 8, 2015 14. Zack, really pleased to see this post. 15. Here’s an issue to consider: I know WordPress has made a deliberate design decision to use absolute URLs, but *must* image src URLs start with a scheme name? If a WordPress site owner tries to move to HTTPS by default from HTTP, then all the image paths have to be updated to eliminate mixed-content warnings in the browser. What about switching to protocol relative URLs, beginning with just // (instead of http:// or [https://](https://make.wordpress.org/core/2015/09/08/wordpress-and-http2/?output_format=md)) for images? 16. Related to that: There is no tool or utility in coreCore Core is the set of software required to run WordPress. The Core Development Team builds WordPress. to update URLs. So if you’ve built a site and it uses URLs that start with [http://](https://make.wordpress.org/core/2015/09/08/wordpress-and-http2/?output_format=md), it’s necessary to install a plugin to change the hardcoded http:// references to [https://](https://make.wordpress.org/core/2015/09/08/wordpress-and-http2/?output_format=md). The backend can be seamlessly forced to HTTPSHTTPS HTTPS is an acronym for Hyper Text Transfer Protocol Secure. HTTPS is the secure version of HTTP, the protocol over which data is sent between your browser and the website that you are connected to. The 'S' at the end of HTTPS stands for 'Secure'. It means all communications between your browser and the website are encrypted. This is especially helpful for protecting sensitive data like banking information. by using the constant FORCE_SSL_ADMIN. Would be nice if there was a way to easily convert a WordPress site to be HTTPS-only on the frontend. Let’s think about usability here… 17. * ![](https://secure.gravatar.com/avatar/1a30c2f9646fb18d064586833015e2b9b44d79d3933d0cb12a8f12fdc6238f79? s=32&d=mm&r=g) * [Zack Tollman](https://profiles.wordpress.org/tollmanz/) 7:30 pm _on_ September 8, 2015 * Your point is well taken. The mixed content issue is probably the biggest issue WP has with HTTPSHTTPS HTTPS is an acronym for Hyper Text Transfer Protocol Secure. HTTPS is the secure version of HTTP, the protocol over which data is sent between your browser and the website that you are connected to. The 'S' at the end of HTTPS stands for 'Secure'. It means all communications between your browser and the website are encrypted. This is especially helpful for protecting sensitive data like banking information. and manifests itself in a number of ways. There are a number of tickets related to this issue in the list above. * I would recommend that we do not use protocol-relative URLs and instead just use HTTPS. This seems to be becoming a best practice as we move toward an HTTPS everywhere web (1, 2). * I absolutely love your idea of a tool to update URLs, but I think this is pluginPlugin A plugin is a piece of software containing a group of functions that can be added to a WordPress website. They can extend functionality or add new features to your WordPress websites. WordPress plugins are written in the PHP programming language and integrate seamlessly with WordPress. These can be free in the WordPress.org Plugin Directory [https://wordpress.org/plugins/](https://wordpress.org/plugins/) or can be cost-based plugin from a third-party. area for the time being. Regardless, it should be built and arguments about where it lives can come later. * We absolutely must think about usability and I think our HTTPHTTP HTTP is an acronym for Hyper Text Transfer Protocol. HTTP is the underlying protocol used by the World Wide Web and this protocol defines how messages are formatted and transmitted, and what actions Web servers and browsers should take in response to various commands./2 conversations will start there. We have the 5-minute install for WP, but then there is a lot of extra effort to make it work with HTTPS, especially if you are migrating a site. * 1. [http://www.paulirish.com/2010/the-protocol-relative-url/](http://www.paulirish.com/2010/the-protocol-relative-url/) 2. [https://www.digitalgov.gov/2015/08/14/secure-central-hosting-for-the-digital-analytics-program/](https://www.digitalgov.gov/2015/08/14/secure-central-hosting-for-the-digital-analytics-program/) 18. ![](https://secure.gravatar.com/avatar/9516145f3e5331ee02a076c07ed5878295d698cbd2e7eab1574d3085fa4a935c? s=32&d=mm&r=g) 19. [Ihor Vorotnov](https://profiles.wordpress.org/headonfire/) 6:52 pm _on_ September 8, 2015 20. It’s running on Nghttpx? There’s an early version of HTTPHTTP HTTP is an acronym for Hyper Text Transfer Protocol. HTTP is the underlying protocol used by the World Wide Web and this protocol defines how messages are formatted and transmitted, and what actions Web servers and browsers should take in response to various commands./ 2 for NginxNGINX NGINX is open source software for web serving, reverse proxying, caching, load balancing, media streaming, and more. It started out as a web server designed for maximum performance and stability. In addition to its HTTP server capabilities, NGINX can also function as a proxy server for email (IMAP, POP3, and SMTP) and a reverse proxy and load balancer for HTTP, TCP, and UDP servers. [https://www.nginx.com/](https://www.nginx.com/). already available. 21. * ![](https://secure.gravatar.com/avatar/1a30c2f9646fb18d064586833015e2b9b44d79d3933d0cb12a8f12fdc6238f79? s=32&d=mm&r=g) * [Zack Tollman](https://profiles.wordpress.org/tollmanz/) 7:00 pm _on_ September 8, 2015 * [https://http2.wphttp.com](https://http2.wphttp.com) is running nghttpx. I chose that because it has support for server push, whereas the NginxNGINX NGINX is open source software for web serving, reverse proxying, caching, load balancing, media streaming, and more. It started out as a web server designed for maximum performance and stability. In addition to its HTTP server capabilities, NGINX can also function as a proxy server for email (IMAP, POP3, and SMTP) and a reverse proxy and load balancer for HTTP, TCP, and UDP servers. [https://www.nginx.com/](https://www.nginx.com/). alpha with HTTPHTTP HTTP is an acronym for Hyper Text Transfer Protocol. HTTP is the underlying protocol used by the World Wide Web and this protocol defines how messages are formatted and transmitted, and what actions Web servers and browsers should take in response to various commands./2 support does not. I would like to experiment with server push a bit. - ![](https://secure.gravatar.com/avatar/b08b3ac375d3b073a7de49cab22f621e759f0aadf4a5157a5ec36ffb71f52a67? s=32&d=mm&r=g) - [Joseph Scott](https://profiles.wordpress.org/josephscott/) 3:13 am _on_ September 9, 2015 - The first release of NginxNGINX NGINX is open source software for web serving, reverse proxying, caching, load balancing, media streaming, and more. It started out as a web server designed for maximum performance and stability. In addition to its HTTP server capabilities, NGINX can also function as a proxy server for email (IMAP, POP3, and SMTP) and a reverse proxy and load balancer for HTTP, TCP, and UDP servers. [https://www.nginx.com/](https://www.nginx.com/). with HTTPHTTP HTTP is an acronym for Hyper Text Transfer Protocol. HTTP is the underlying protocol used by the World Wide Web and this protocol defines how messages are formatted and transmitted, and what actions Web servers and browsers should take in response to various commands./2 support isn’t going to have server push support either ( from [https://www.nginx.com/blog/early-alpha-patch-http2/](https://www.nginx.com/blog/early-alpha-patch-http2/)) - > HTTP/2’s ‘Server Push’ feature is not supported in this patchpatch A > special text file that describes changes to code, by identifying the files > and lines which are added, removed, and altered. It may also be referred > to as a **diff**. A patch can be _applied_ to a codebase for testing. > and will not be supported in the first production-ready release of the > HTTP/2 implementation. This feature might appear in a future NGINX release. - It may be that we’ll see HTTP servers implement different sets of HTTP/2 features. In which case knobs for specific features may be a reasonable option. 22. ![](https://secure.gravatar.com/avatar/1ccfcb1daa6c0b064e043799302012690fa5cfd4301d6e50bc08f2795cebe87b? s=32&d=mm&r=g) 23. [galbaras](https://profiles.wordpress.org/galbaras/) 10:50 pm _on_ September 8, 2015 24. It will be a good idea to add HTTPHTTP HTTP is an acronym for Hyper Text Transfer Protocol. HTTP is the underlying protocol used by the World Wide Web and this protocol defines how messages are formatted and transmitted, and what actions Web servers and browsers should take in response to various commands./2 Support as an attribute for things in the wordpress.orgWordPress.org The community site where WordPress code is created and shared by the users. This is where you can download the source code for WordPress core, plugins and themes as well as the central location for community conversations and organization. [https://wordpress.org/](https://wordpress.org/) repository of plugins and themes, so that site builders can find that out quickly when looking for suitable components. 25. ![](https://secure.gravatar.com/avatar/0608b540c7da83b396fd9a453ad1ac0298152522bc3a06888d41649e4024a089? s=32&d=mm&r=g) 26. [Ahmad Awais](https://profiles.wordpress.org/mrahmadawais/) 5:20 am _on_ September 9, 2015 27. I’d love to volunteer! As a front-end (though Full Stack Developer) I have deep interest in HTTPHTTP HTTP is an acronym for Hyper Text Transfer Protocol. HTTP is the underlying protocol used by the World Wide Web and this protocol defines how messages are formatted and transmitted, and what actions Web servers and browsers should take in response to various commands./2, as a matter of fact I wrote about it, recently [https://ahmadawais.com/wordpress-and-http2-what-developers-need-to-know/](https://ahmadawais.com/wordpress-and-http2-what-developers-need-to-know/) 28. * ![](https://secure.gravatar.com/avatar/1a30c2f9646fb18d064586833015e2b9b44d79d3933d0cb12a8f12fdc6238f79? s=32&d=mm&r=g) * [Zack Tollman](https://profiles.wordpress.org/tollmanz/) 2:46 pm _on_ September 9, 2015 * Excellent article! I look forward to having you on board. - ![](https://secure.gravatar.com/avatar/0608b540c7da83b396fd9a453ad1ac0298152522bc3a06888d41649e4024a089? s=32&d=mm&r=g) - [Ahmad Awais](https://profiles.wordpress.org/mrahmadawais/) 12:37 am _on_ September 10, 2015 - Thanks 🙂 29. ![](https://secure.gravatar.com/avatar/6ce8b152434ca178ccad4a79254d5302826f8e07a1d087983cdf5211670a3c23? s=32&d=mm&r=g) 30. [Tryon Eggleston](https://profiles.wordpress.org/tryon/) 8:56 pm _on_ September 16, 2015 31. I would like to help out. I recently worked on a provision script that enables HTTPHTTP HTTP is an acronym for Hyper Text Transfer Protocol. HTTP is the underlying protocol used by the World Wide Web and this protocol defines how messages are formatted and transmitted, and what actions Web servers and browsers should take in response to various commands./2 for VVV via nghttpx: [https://github.com/tryonegg/vvv-h2/](https://github.com/tryonegg/vvv-h2/) 32. ![](https://secure.gravatar.com/avatar/1d442bc94c6f4198991d0886f34c9d6482710d5a15ad5e358ef802e2a41818be? s=32&d=mm&r=g) 33. [Slava UA](https://profiles.wordpress.org/slaffik/) 5:36 pm _on_ November 11, 2015 34. [@tollmaz](https://profiles.wordpress.org/tollmaz/) [http://http11.wphttp.com/](http://http11.wphttp.com/) doesn’t work. `Loop detected on ...` 35. ![](https://secure.gravatar.com/avatar/1d442bc94c6f4198991d0886f34c9d6482710d5a15ad5e358ef802e2a41818be? s=32&d=mm&r=g) 36. [Slava UA](https://profiles.wordpress.org/slaffik/) 5:40 pm _on_ November 11, 2015 37. Why are you using batcache on http2? Doesn’t the demo should illustrate the clean WordPress version? Comments are closed. # Post navigation [← WP REST API v2 Documentation Meeting](https://make.wordpress.org/core/2015/09/07/wp-rest-api-v2-docs/) [oEmbed Update: September 9th →](https://make.wordpress.org/core/2015/09/09/oembed-update-september-9th/)