Caddy Protocols
You set up caddy protocols by declaring listener ports and transport versions in your server file. The web server then negotiates HTTP/1.1, HTTP/2, and HTTP/3 traffic with client browsers on its own. Most engineering teams start by leaving all default protocol listeners active for every public route. This broad setup creates risk when internal admin apps share listeners with public web traffic. Overly broad listener rules expose backend services to unexpected traffic types and unauthorized netwo
Emergency Access Protocols: the complete guide
Architecture patterns, implementation strategies, and security best practices. Delivered to your inbox.
You set up caddy protocols by declaring listener ports and transport versions in your server file. The web server then negotiates HTTP/1.1, HTTP/2, and HTTP/3 traffic with client browsers on its own. Most engineering teams start by leaving all default protocol listeners active for every public route. This broad setup creates risk when internal admin apps share listeners with public web traffic. Overly broad listener rules expose backend services to unexpected traffic types and unauthorized network probes.
How caddy protocols work in modern web architectures
A modern web server must speak several network languages at the exact same time. Caddy binds to standard network ports and listens for both TCP and UDP packets. When a client reaches out, the server checks the TLS handshake to pick the best protocol. It supports classic HTTP/1.1 for older scripts and legacy backend tools. It also runs HTTP/2 over TCP to send multiple streams over one link. For newer browsers, it runs HTTP/3 over QUIC using UDP packets to cut down latency.
Teams control caddy protocols by defining server blocks and listener rules in the main settings file. You can restrict a specific host or port to only accept a single protocol version. The server also handles TLS certificate creation and renewal without manual work from your team. During the TLS handshake, the server uses app layer negotiation to agree on the protocol version. Once both sides agree, the server decrypts the traffic and routes it to the upstream app. For backend services that use gRPC, the server keeps end-to-end HTTP/2 streams open.
Where native protocol settings stop and runtime gaps begin
Native server rules do a great job of managing network transport and encryption. They make sure that external clients use safe ciphers and modern HTTP versions. They also let platform teams block UDP traffic on ports that do not need HTTP/3. You can even require client certificates at the listener level to check who logs in. These transport checks stop bad handshakes before a packet ever reaches your internal app.
Still, protocol settings only decide how packets travel and who opens a network link. Once a user passes the TLS check, the web server forwards every valid request downstream. The server does not inspect the database queries or system commands hidden inside the payload. It cannot require peer approval before a developer runs a destructive request against an admin route. It also cannot rewrite sensitive fields like emails or card numbers in the response body. Transport rules secure the pipe, but they do not govern what happens inside an active session.
Hardening upstream routing and internal service traffic
To reduce risk, teams should separate public listener blocks from internal admin routes. You should disable older protocol versions if your client apps do not need them. Teams should also restrict which upstream hosts can accept long-lived streams like WebSockets or gRPC. Setting strict timeouts on read and write streams stops slow requests from locking up server memory. Clear listener boundaries make it much easier to audit how traffic enters your network.
Emergency Access Protocols: architecture patterns and best practices
Continue reading? Get the full guide.
Free. No spam. Unsubscribe anytime.
Even with strict listener boundaries, engineers still need direct ways to debug production backends. When an engineer troubleshoots an API or database behind the web server, network rules fall short. Teams need a way to inspect individual commands and mask sensitive data like phone numbers in results. Pairing solid web transport rules with command-level controls gives teams full visibility across the stack.
Add runtime guardrails and masking beside your databases and APIs
Login rules, role grants, and CI checks govern who connects to your stack. Yet any allowed script, engineer, or AI agent still runs commands with the full scope of its role. For workloads on Postgres, MySQL, SQL Server, MongoDB, ClickHouse, Kubernetes, SSH, or internal HTTP services, hoop.dev sits beside the service as an open-source proxy, a sidecar for your database or API.
Before a query runs, hoop.dev guardrails check the statement against your rules. An AI Analyzer you configure can score intent or hold risky calls for human review. Next, hoop.dev data masking rewrites sensitive fields in responses, and each verdict is logged per listener. Explore the MIT-licensed project on GitHub.
Frequently asked questions
Which HTTP versions do caddy protocols enable by default?
By default, the server enables HTTP/1.1, HTTP/2, and HTTP/3 on all standard HTTPS listeners. It picks the fastest version that the client browser supports during the initial TLS handshake.
Can I turn off HTTP/3 on specific server ports?
Yes, you can edit the listener protocol settings in your main server file. Removing the HTTP/3 option stops the server from advertising QUIC support on that specific port.
How does the server handle WebSocket and gRPC traffic?
The server detects WebSocket upgrade headers over HTTP/1.1 and HTTP/2 without extra plugins. For gRPC traffic, it forwards framed HTTP/2 streams directly to your backend app service.
Short role checks help teams work fast. Simple rules make each review clear. Good logs keep every team safe. Scoped keys stop bad changes early.