Panellicense

Enable HTTP/3 and QUIC on LiteSpeed Enterprise for cPanel

Turn on HTTP/3 and QUIC for LiteSpeed Enterprise on a cPanel server — UDP 443, firewall rules, Cloudflare passthrough, and a 30-second check that it actually serves.

8 min readUpdated 2026-05-16litespeed · http3 · quic · cpanel
schema: HowToschema: FAQPageschema: BreadcrumbList

LiteSpeed Enterprise has supported IETF HTTP/3 since v5.4 and ships with it on by default from v6.0 onward. The catch is that "on by default" only means the listener is configured — nothing serves over QUIC until UDP port 443 is open both ways and you've confirmed the Alt-Svc handshake reaches the browser.

This guide covers the full path on a cPanel server: confirm your build, open the firewall, flip the listener, handle Cloudflare or a CDN in front, and verify with curl. End to end this is 15 minutes on a server you've already migrated to LSWS.

Why HTTP/3 actually matters on shared hosting

HTTP/2 multiplexes streams over a single TCP connection, but a single dropped packet stalls every stream until it's retransmitted — TCP head-of-line blocking. HTTP/3 runs over QUIC, which multiplexes streams over UDP with per-stream loss recovery, so a packet loss on one stream doesn't pause the others. On flaky mobile networks the difference is real: TTFB drops 10–30% on lossy connections, and 0-RTT resumption shaves a full round trip off returning visitors.

Apache has no usable HTTP/3 module. Nginx requires a patched build. LiteSpeed is one of two production-ready options (the other being Cloudflare in front), which is the main operational reason to move off Apache. If you haven't yet, the LiteSpeed install guide for cPanel covers the switch with zero downtime.

Step 1 — Confirm the LSWS build supports HTTP/3

OpenLiteSpeed and LSWS Free Starter do not ship the QUIC engine. You need LiteSpeed Web Server Enterprise v5.4 or newer. v6.x is recommended — it ships with QUIC v1 (RFC 9000) rather than the older draft versions some browsers have dropped support for.

/usr/local/lsws/bin/lshttpd -v

If you see anything below 5.4, upgrade before continuing:

/usr/local/lsws/admin/misc/lsup.sh -f -v latest

The upgrade is in-place and takes under a minute. Existing connections drain via the graceful restart.

Step 2 — Open UDP 443 in the firewall

This is the step that bites everyone. HTTP/3 runs over UDP, not TCP — opening TCP 443 for HTTPS does nothing for QUIC. Most cPanel servers run CSF, so edit /etc/csf/csf.conf:

TCP_IN  = "20,21,22,25,53,80,110,143,443,465,587,993,995,2077,2078,2082,2083,2086,2087,2095,2096,3306"
UDP_IN  = "20,21,53,443"
UDP_OUT = "20,21,53,123,443"

Apply and reload:

csf -r

If you're on a cloud provider with a security-group firewall in front (AWS, GCP, Hetzner Cloud, OVH ECC), add an inbound rule there too. Forgetting the cloud-level firewall is the single most common cause of "I enabled QUIC and nothing happened" tickets.

Step 3 — Enable the QUIC listener in WebAdmin

Log into the LSWS WebAdmin Console (typically https://your-server:7080) and navigate to Listeners → SSL Listener → Edit. Under General, confirm:

  • Address: *:443
  • Secure: Yes
  • Binding: leave as-is (usually LSWS Process #1)

Then under Security → QUIC:

  • Enable QUIC: Yes
  • QUIC Stream Flow Control Window: 15728640 (default 15 MB — leave it)
  • QUIC Connection Flow Control Window: 25165824 (default 24 MB — leave it)

Save and do a graceful restart from the WebAdmin top bar.

If you prefer the config file directly, the relevant block in /usr/local/lsws/conf/httpd_config.conf is:

listener Default {
  address                 *:443
  secure                  1
  enableQuic              1
}

Reload after editing:

/usr/local/lsws/bin/lswsctrl restart

Step 4 — Handle Cloudflare or another CDN in front

If your customer domains are proxied through Cloudflare (orange cloud), HTTP/3 terminates at Cloudflare's edge, not your origin. Browsers speak HTTP/3 to Cloudflare; Cloudflare speaks HTTP/2 over TCP to your LSWS. That's fine — the user-visible benefit is fully captured at the edge.

For DNS-only (grey cloud) records, the client connects directly to LSWS and gets the native HTTP/3 experience. No further config needed.

If you also want HTTP/3 between Cloudflare and your origin (negligible benefit for most sites — that hop is usually low-latency wired), it requires the Cloudflare Origin Rules / Argo tier and isn't worth the complexity for shared hosting.

Step 5 — Verify HTTP/3 is actually serving

Three checks, in order of usefulness:

# 1. curl with HTTP/3 (curl must be built with --http3)
curl -I --http3 https://example.com

# Expected: HTTP/3 200 in the response

# 2. Confirm the Alt-Svc header advertises h3
curl -sI https://example.com | grep -i alt-svc

# Expected: alt-svc: h3=":443"; ma=2592000

# 3. From a browser DevTools Network tab, check the "Protocol" column.
# h3 means HTTP/3 served. h2 means the client fell back to TCP.

The first request to a domain is always HTTP/2 — the browser doesn't know HTTP/3 is available until it sees the Alt-Svc header, and only upgrades on the next request. This is the QUIC discovery model and there's no way around it. The 30-day ma (max-age) caches the discovery so returning visitors connect via HTTP/3 immediately.

If curl --http3 fails but alt-svc is present in the headers, the listener config is fine and the firewall is dropping UDP. Re-check step 2.

Step 6 — TLS 1.3 is mandatory

HTTP/3 only works over TLS 1.3. LSWS supports it natively, but if you've explicitly restricted ciphers to TLS 1.2 only in SSL Listener → SSL → SSL Protocol, QUIC negotiation silently fails. The setting you want is:

TLSv1.2 TLSv1.3

Not TLSv1.2 alone, and definitely not TLSv1.0 TLSv1.1 — those are deprecated and don't buy you compatibility with anything still in the wild.

Common gotchas

  1. MTU issues on tunnelled networks. QUIC discovers path MTU via PLPMTUD. Most servers handle this fine, but if you're running LSWS behind a Wireguard tunnel or on a provider with non-standard MTU (some Hetzner Cloud setups default to 1450), expect intermittent connection failures. Setting enableQuicMaxUdpPayloadSize 1350 in httpd_config.conf fixes it.
  2. 0-RTT and replay attacks. LSWS allows 0-RTT resumption by default, which is great for GET request latency but unsafe for any endpoint that mutates state on GET. If your customers are running ancient applications that violate REST semantics, disable 0-RTT under Listener → QUIC → Allow 0-RTT = No.
  3. CageFS and CloudLinux. QUIC needs no CageFS adjustments — LSWS runs outside the cage. If you're tuning LVE limits for shared hosting, they apply to the PHP backend the same way regardless of front-end protocol.
  4. NAT timeouts on UDP. TCP keeps connection state via FIN; UDP relies on idle timeouts. Cheap routers default to 30s UDP timeout, which kills idle QUIC connections. LSWS sends keepalive pings, but client-side NATs are the issue and there's nothing the server can do. Real impact is small — connections re-establish in <100ms.

FAQ

Does OpenLiteSpeed support HTTP/3?+
Yes, OpenLiteSpeed 1.7+ supports HTTP/3 with the same config flags. The QUIC engine is the same. The differences between OLS and LSWS Enterprise are around LSAPI, ESI, and per-VHost cache controls — covered in our [LiteSpeed vs OpenLiteSpeed comparison](/kb/litespeed-vs-openlitespeed).
Will enabling HTTP/3 break HTTP/2 clients?+
No. LSWS serves HTTP/2 over TCP and HTTP/3 over UDP from the same listener. Clients that don't speak HTTP/3 simply ignore the Alt-Svc header and continue over HTTP/2. There is no downgrade for older browsers.
Why is my browser still showing h2 in DevTools after enabling QUIC?+
Three causes in order of likelihood: (1) the browser hasn't seen the Alt-Svc header yet — refresh once and check again; (2) UDP 443 is blocked at the cloud firewall, not just CSF; (3) you're behind a Cloudflare proxy that terminates HTTP/3 at the edge, so the protocol shown is the browser-to-Cloudflare hop, not Cloudflare-to-origin.
Does HTTP/3 require a separate SSL certificate?+
No. QUIC uses the same TLS 1.3 certificate as HTTPS. AutoSSL-issued certs work without modification. If AutoSSL is failing, see [the AutoSSL decision tree](/kb/whm-autossl-failures) — fix the cert first, then enable QUIC.
How much CPU does HTTP/3 add compared to HTTP/2?+
Roughly 5–15% higher per-request CPU for crypto and stream management at the LSWS level. Offset is reduced retransmission overhead on lossy networks, so on real shared-hosting traffic with mobile clients the net change is within noise. Hardware AES-NI helps significantly — confirm with `cat /proc/cpuinfo | grep aes`.
Can I enable HTTP/3 on a per-VHost basis, or is it server-wide?+
It's per-listener. If you have separate listeners for different IP/port pairs you can enable QUIC on some and not others, but every VHost on a given listener inherits the setting. In practice everyone wants it on for all virtual hosts.

Next steps

Related articles

All tutorials & how-tos →
how to
Set up JetBackup 5 deduplication backups to cut storage cost
JetBackup 5.4 added a deduplication backup structure that fingerprints data in chunks and stores each unique chunk once — here's how it works, where it pays off, and how to turn it on.
6 min read
how to
Plesk 360 setup guide for centralized licenses and monitoring
Plesk 360 is the SaaS control plane for everyone running more than one Plesk box — license management, uptime monitoring, and SSO into every panel from one dashboard.
7 min read
how to
Use the Plesk REST API with reseller and customer accounts
Plesk Obsidian 18.0.79 opens the REST API to reseller and customer accounts and adds file, log, and impersonation endpoints — how to authenticate and use them.
7 min read
Switch in an afternoon

Switch from your current reseller — free.

We migrate active cPanel, Plesk, LiteSpeed and CloudLinux licenses from any reseller. We prorate the first month so you never pay twice, and your customers see zero downtime during the swap.