Driver FixRecommendedSound, Wi-Fi or graphics acting up? Check drivers firstFind missing or outdated drivers fast.Check DriversOctober DealsAmazon USOctober deal check: compare before you payAmazon US: current deals, useful picks and tech finds.Check DealsWindows FixRecommendedWindows errors stealing your time? Find the fix fastScan stability, cleanup and performance issues.Fix Now×
Skip to content
World desk4 min

How to Enable HTTP/2 and HTTP/3 for a Laravel App with Nginx

Enable HTTP/2 in Nginx’s TLS server block, then add HTTP/3 only after checking build support, TLS 1.3, UDP reachability, and negotiated protocol.
Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

Enable HTTP/2 by updating the Nginx TLS server block; HTTP/3 is an optional addition that also needs a compatible Nginx build, TLS 1.3, and reachable UDP. Laravel does not need a different front controller: keep serving the app from its public directory and pass PHP requests to PHP-FPM.

Keep Laravel’s existing document root and routing

Start with your current Laravel Nginx server block—or Laravel’s deployment example—and change the protocol settings without changing how the application is served. The document root should point to the project’s public directory. Laravel warns that serving the project root can expose sensitive configuration files. Its deployment example uses try_files to send unmatched requests to public/index.php, which is then handled by PHP-FPM.

As an Amazon Associate I earn from qualifying purchases.

Laravel 13’s deployment documentation lists PHP 8.3 or later. Adjust the PHP-FPM socket and hostname in its example to match your server. The protocol change belongs in Nginx and its TLS setup, not in Laravel’s front-controller architecture. See Laravel’s deployment documentation.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

Enable HTTP/2 over your existing HTTPS listener

For current Nginx configuration, keep the TLS listener and enable HTTP/2 with the separate http2 on; directive:

server {
    listen 443 ssl;
    http2 on;

    server_name example.com;
    ssl_certificate     /path/to/fullchain.pem;
    ssl_certificate_key /path/to/private-key.pem;
    ssl_protocols TLSv1.2 TLSv1.3;

    # Keep the existing Laravel public root, try_files, and PHP-FPM locations.
}

The separate http2 directive was introduced in Nginx 1.25.1. Older examples may put http2 directly on the listen line; use the syntax supported by your installed version. Nginx also requires ALPN support for HTTP/2 over TLS; its documentation identifies OpenSSL 1.0.2 as the version from which ALPN is available. Check the Nginx HTTP/2 module documentation.

Keep the private-key file readable by the Nginx master process but restrict access to it. Nginx’s HTTPS configuration guide covers certificate, key, and TLS configuration.

Add HTTP/3 only if the build and network support it

Nginx HTTP/3 uses QUIC over UDP. The optional ngx_http_v3_module requires a compatible build and TLS 1.3; the HTTP/3 listener does not replace the ordinary TCP HTTPS listener. Keep TCP HTTPS available for clients that use HTTP/1.1 or HTTP/2.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

Nginx’s QUIC guide says support has been available since Nginx 1.25.0 and is included in Linux binary packages; source builds need --with-http_v3_module. The module documentation lists OpenSSL 1.1.1 or later as a requirement. Check the exact installed package and linked SSL library rather than assuming every Nginx build has the same capabilities.

Nginx describes the module as experimental: “The module is experimental, caveat emptor applies.” HTTP/3’s 0-RTT feature is not required for ordinary HTTP/3 and should not be enabled as a routine configuration step; it has stricter TLS-library requirements and requires a separate application-level replay-risk assessment. See the HTTP/3 module documentation and QUIC setup guide.

Illustrative combined server block

This protocol-focused sketch shows the relevant directives, not a tested, drop-in Laravel configuration. Retain your existing Laravel root, try_files, and PHP-FPM locations, and verify your installed Nginx accepts every directive.

Rank #3
Forvencer Server Book, 2 Zipper Pocket, Server Books for Waitress
  • Upgraded Two Zipper Pockets: Forvencer server books feature two secure zipper pockets for better organization of coins, cash, and receipts, ensuring that everything you collect has a safe and secure place
  • Smart Storage & Quick Access: Designed with 8 multi-functional compartments, the right side includes a guest receipt pad, while the left has a money pocket, ticket pocket, and credit card slot. Two small clear pockets store bills, receipts, and other visible items. A stitched pen loop ensures you always have your favorite pen ready
  • High-quality & Easy to Clean: Crafted from high-quality PU leather with heavy-duty stitching, this server book is built to last. It resists tears, scratches, and its waterproof surface makes cleaning easy with just a damp cloth or a non-chlorine sanitizer
  • Perfect Fit for Your Apron: Measuring 5” x 8”, this compact organizer is slightly smaller than other models, making it ideal for bending or sitting while carrying in your server apron. It holds everything a waitress needs—a place for everything
  • What's Included: This server organizer comes with multiple open and zippered pockets to store money, receipts, tips, etc. Clear sleeves are perfect for keeping menus or special lists while serving. Available in a variety of colors, allowing you to express yourself even when in uniform
server {
    listen 443 ssl;
    http2 on;

    # QUIC uses UDP; retain the TCP HTTPS listener above.
    listen 443 quic reuseport;

    server_name example.com;
    ssl_certificate     /path/to/fullchain.pem;
    ssl_certificate_key /path/to/private-key.pem;
    ssl_protocols TLSv1.2 TLSv1.3;

    # Keep Laravel's existing public root, try_files, and PHP-FPM locations.

    add_header Alt-Svc 'h3=":443"; ma=86400' always;
}

The Alt-Svc header advertises HTTP/3 to clients; it does not prove that QUIC connections can reach the server. Make sure the port in the advertisement is the externally reachable UDP port. Nginx’s example uses reuseport, which its QUIC guide says is useful when running multiple workers.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

Allow UDP end to end

Permit UDP on the advertised port in the host firewall and any cloud security group, load balancer, or network appliance between clients and Nginx. A TCP-only HTTPS path can serve HTTP/1.1 and HTTP/2 while QUIC remains unreachable, so check network controls as well as Nginx configuration.

Check the Nginx build before troubleshooting HTTP/3

  1. Inspect the version, build options, and SSL library with nginx -V. Confirm the installed package includes ngx_http_v3_module; if you built Nginx from source, check that it was compiled with --with-http_v3_module.

  2. Test the configuration with nginx -t. If it passes, reload Nginx using the service procedure for your operating system.

  3. Confirm TCP port 443 still serves HTTPS and that UDP on the advertised HTTP/3 port is reachable from outside the server.

    Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.
  4. Inspect a response for the Alt-Svc header. Then use a browser’s network panel or a command-line client to check the protocol actually negotiated; an advertisement alone does not demonstrate a successful QUIC connection.

For QUIC failures, Nginx recommends testing with a console client such as ngtcp2 before focusing on browser behavior. A debug build’s logs can provide further clues; Nginx notes that QUIC messages in those logs carry a quic prefix. Its QUIC guide describes the build and diagnostic checks.

Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Support on Ko-Fi

Account for TLS termination before Laravel

If a load balancer or reverse proxy terminates TLS and forwards plain HTTP to Laravel, the app may see an internal port-80 request and generate HTTP URLs. Configure Laravel’s trustProxies in bootstrap/app.php for the actual trusted proxy addresses and the forwarded headers used by your deployment. Do not trust arbitrary proxies unless your topology warrants it. See Laravel’s trusted-proxy documentation.

Check package security advisories for your exact build

Security status depends on the product, package, and version. NGINX Plus release notes dated September 15, 2026, describe a fix for a limited heap buffer overflow under certain HTTP/3 configurations using OpenSSL 3.5.0 and earlier. That product-specific note is not a blanket statement about every Nginx package. Review current Nginx and distribution advisories for the exact build and TLS library you run. See the NGINX Plus release notes.

Free tools Windows power users keep installed

One-click scans. No signup required.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

Measure before expecting a speedup

Enabling a protocol does not establish that a particular Laravel site will be faster. To compare HTTP/2 and HTTP/3 on your own workload, measure page or API latency, behavior under packet loss and high latency, CPU use, connection success across your target clients, and the operational complexity of the deployment under the same conditions. Treat the result as workload-specific, not a guaranteed protocol benefit.

Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.

Leave a Reply

Your email address will not be published. Required fields are marked *

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

More from the Wire

  1. World desk4 min
    How to Spot an AI Voice Scam Before Sending MoneyDon’t rely on how a caller sounds. Pause, call back through a known number, and verify the emergency with another trusted person before sending money.
  2. Mountain View desk4 min
    Google’s SynthID Detector: How to Check AI-Generated Images, Video and AudioGoogle’s SynthID Detector looks for an embedded watermark in supported images, video and audio. Here is what its results do—and do not—show.
  3. Redmond desk20 min
    How to create a link to File or Folder in Windows 11Windows 11 gives you several ways to point to a file or folder without moving or duplicating it. You can create a desktop shortcut,…
Recommended PC Tool
Recommended PC Tool
PC Slower Than It Used to Be?Free scan - under a minute
Outdated Drivers Are Slowing You DownFree scan - exact matches

Two free Windows tools

One Free Minute Could Fix That PC

Before you go - each of these free tools takes about a minute and tackles what quietly slows a Windows PC down.

Special offer. View Outbyte info, uninstall instructions, EULA, and Privacy Policy.