Free tool · runs in your browser

WebTransport server-readiness checklist

Interactive checklist for a WebTransport server: UDP, HTTP/3, certificates, settings, CONNECT, origin, firewall. Copy a what-to-check-next report.

WebTransport Day

Published October 28, 2026

Last updated: October 28, 2026
Facts checked: October 28, 2026

The checklist

Works without JavaScript as a plain list; with JavaScript it counts what you have confirmed and builds a report.

1. UDP is reachable on the port Check: The server listens on a UDP port, and nothing between the client and the server blocks inbound UDP to that port. Why: QUIC runs over UDP, so a TCP-only listener or a UDP-filtering firewall means no session can start.
Source: RFC 9000: QUIC
2. HTTP/3 is served, with ALPN h3 Check: The server completes a QUIC handshake and negotiates the h3 application protocol (ALPN). Why: WebTransport over HTTP/3 builds on an HTTP/3 connection. A server that only speaks HTTP/1.1 or HTTP/2 over TCP cannot accept it.
Source: RFC 9114: HTTP/3
3. The certificate is trusted, or meets the serverCertificateHashes rules Check: Either the certificate chains to a trusted authority for the hostname, or (for development) it uses an ECDSA P-256 key, is valid for less than two weeks, and its SHA-256 hash is passed as serverCertificateHashes. Why: Certificate errors are fatal for the connection, and browsers do not say which hop failed.
Source: MDN: WebTransport() constructor
4. WebTransport is enabled in the HTTP/3 settings Check: The server sends the HTTP/3 settings that enable extended CONNECT, HTTP Datagrams and WebTransport, and allows QUIC datagrams (max_datagram_frame_size above zero). Why: Per the IETF draft, a client must not start a session if these are missing.
Draft-specific: The WebTransport setting name is defined by the draft and may change before it becomes an RFC. Check the draft version your library implements.

Source: IETF draft-ietf-webtrans-http3
5. Extended CONNECT is accepted at the exact path Check: A CONNECT request for the URL path from your client is answered with a 2xx status; unknown paths answer with an error such as 405, and redirects are not used. Why: The draft has clients treat only a 2xx response as an accepted session and not follow redirects for this request.
Source: IETF draft-ietf-webtrans-http3
6. The origin policy allows your page Check: The server accepts the Origin header your page sends (or accepts any origin on purpose for a public test server). Why: Browsers include an Origin header and a server may reject origins it does not trust; the draft suggests a 403 response.
Source: IETF draft-ietf-webtrans-http3
7. Firewalls, NAT and load balancers pass UDP and QUIC Check: Security groups, NAT rules and any load balancer in front of the server pass UDP in both directions and, for a load balancer, support UDP or QUIC passthrough. Why: Many CDNs and HTTP load balancers terminate HTTP/3 only toward users. See what providers document on the serverless and edge page.
Source: WebTransport and serverless or edge platforms

0 of 7 confirmed

What to check next

Test a connection in the tester →

How do I use the checklist?

Work through the items from top to bottom, tick each one you have confirmed on the server you are testing, and copy the report of unchecked items. The order follows the path a connection takes: network first, then QUIC and TLS, then HTTP/3 and WebTransport, then policy. If you tick everything and the connection still fails, test with the WebTransport tester and read debugging handshake errors.

What does each item mean?

Each item states what to verify and why, with the source it comes from. Names such as the HTTP/3 settings are defined by the IETF draft, which can change.

Frequently asked questions

Does this checklist test my server?

No. It cannot open QUIC connections to your server for you; it is a checklist you complete by hand, and it produces a copyable list of what to check next. To test a connection from your browser, use the WebTransport tester.

Why are some setting names marked draft-specific?

WebTransport over HTTP/3 is still an IETF draft, and the names of some HTTP/3 settings are defined by that draft. They may change before it becomes an RFC, so check the draft your server library implements.

Does my page need to be on the same origin as the server?

No. Browsers send an Origin header, and the server decides which origins to accept. A server that rejects your page origin is a common cause of failed connections.

Sources

Facts on this page were last checked against these sources on October 28, 2026.

Cite this page

Title: WebTransport server-readiness checklist
Author: WebTransport Day (organization)
URL: https://webtransport.day/tools/server-checklist/
Updated: October 28, 2026

WebTransport Day. "WebTransport server-readiness checklist." Last updated October 28, 2026. https://webtransport.day/tools/server-checklist/

Report an error on this page