App Service web apps should use the latest 'HTTP Version' when used to run the app
Evaluates each Azure App Service web app configuration and reports whether the `http20_enabled` site setting is turned on, so the app serves clients over `HTTP/2` instead of falling back to the older `HTTP/1.1` protocol.
Without HTTP/2, apps remain on HTTP/1.1, increasing connection overhead and head-of-line blocking, which can reduce availability under load. Use the latest version of HTTP to ensure you are benefiting from security fixes.
What this control checks
App Service web apps must run on the latest HTTP version available for the app
Common pitfalls
Policy only applies to Linux web apps
Currently, this policy only applies to Linux web apps.
Audit evidence
Evidence that deployed resources meet this control: Prowler check app_ensure_using_http20 (prowler azure --checks app_ensure_using_http20); PowerPipe control azure_compliance.control.appservice_web_app_latest_http_version.
Scans of the Terraform code that flag the same setting before deployment: Checkov check CKV_AZURE_18; Trivy check AZU-0005.
Framework-specific interpretation
NIS2 Directive (EU 2022/2555): Mapped to 5.1.2.a (the cybersecurity practices of the suppliers and service providers, including their secure development procedures;), 6.2.1 (Before developing a network and information system, including software, the relevant entities shall lay down rules for...), 6.2.2.b (apply principles for engineering secure systems and secure coding principles to any information system development...) and 1 more clause.
NIST SP 800-53 Rev 5: Mapped to SI-2 (Flaw Remediation) and SI-2(6) (Removal of Previous Versions of Software and Firmware).
Framework mappings
The clauses this control is mapped to in each framework.
- 5 Supply chain security
- 6 Security in network and information systems acquisition, development and maintenance
- SI-2 Flaw Remediation
- SI-2(6) Removal of Previous Versions of Software and Firmware
- 3.14.1 Identify, report, and correct system flaws in a timely manner
- 9.9 Ensure that 'HTTP Version' is the latest, if used to run the web app
- 9.9 Ensure that 'HTTP Version' is the latest, if used to run the web app
- 9.9 Ensure that 'HTTP Version' is the latest, if used to run the web app
- 9.9 Ensure that 'HTTP Version' is the Latest, if Used to Run the Web App
- 9.8 Ensure that 'HTTP Version' is the Latest, if Used to Run the Web App
- 9.10 Ensure that 'HTTP20enabled' is set to 'true' (if in use)
- SI-2 Flaw Remediation
- 164.312(e)(1) Transmission security
Related controls
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
appservice_web_app_latest_http_version - Checkov Check:
CKV_AZURE_18 - Powerpipe Control:
azure_compliance.control.appservice_web_app_latest_http_version - Prowler Check:
app_ensure_using_http20 - Trivy Check:
AZU-0005
Last reviewed: 2026-10-11