XHTTP Transport for Xray: A Complete Guide to Setup and Differences from HTTP

Introduction

XHTTP transport for Xray has rapidly become one of the most practical ways to disguise traffic as regular HTTP and reliably bypass modern DPI from 2024 through 2026. The reason is simple: many networks continue to allow classic HTTP(S) for legitimate traffic, and XHTTP emulates this dialogue without heavy HTTP/2 or WebSocket framing. In this guide, we'll explore what XHTTP means in the context of Xray, how it works under the hood, how it differs from standard HTTP transport, provide robust DPI-resistant configuration schemes, checklists, tips for performance and observability, as well as common pitfalls that break connections in real networks. In the end, you'll have a systematic methodology to design, deploy, and maintain XHTTP tailored to your scenarios — from home access to corporate perimeter and mobile networks.

Basics

What are Xray and transport?

Xray-core is a high-performance proxy engine offering a flexible model of protocol + transport + encryption. Application-level protocols (VLESS, VMess, Trojan, etc.) handle authentication and session multiplexing, while transport (TCP, WebSocket, HTTP/2, gRPC, QUIC, XHTTP) defines how bytes flow over the network and which network signatures DPI and intermediaries can see. Encryption (TLS/XTLS/REALITY) and client imitation (uTLS, JA3 fingerprints) hide contents and mask the TLS profile to behave like real browsers.

Where does XHTTP fit in this matrix?

XHTTP is a transport mode that mimics the behavior of classic HTTP/1.1 dialogue and supports both TLS and plain TCP (no need for h2c equivalents). Its goal is to present the most "ordinary" DPI profile possible: headers, methods, paths, keep-alive, chunked transfer encoding, Upgrade patterns — then after a legitimate handshake, shift the stream into a bidirectional byte channel for real proxy traffic. From the outside, it looks like a long-lived HTTP request/response with a live connection; internally, it acts as a pipeline for your VLESS/VMess data.

Why does it work against DPI?

• HTTP/1.1 semantics. Most DPI systems "understand" and permit typical HTTP headers, methods (GET/POST/OPTIONS), encodings (chunked), and keep-alive connections.
• Minimal framing. Unlike HTTP/2 and WebSocket, XHTTP doesn’t introduce explicit frames/opcodes, keeping the stream as if it’s a POST body or a connection upgrade. For many inspectors, this is a "normal" pattern.
• Flexible mimicry. Headers (User-Agent, Accept, Referer), paths, hosts, response codes, and even transmission intervals can be tailored to real backend behaviors.

What to compare it with: standard HTTP transport in Xray

Xray provides an HTTP transport (often HTTP/2 or h2c-like modes) oriented around framing and multiplexing streams inside HTTP/2. This approach is convenient but leaves obvious fingerprints (ALPN h2, HPACK profiles, specific prefaces) and requires more complex negotiation. XHTTP avoids clear HTTP/2 signals and is often preferable in "restricted" networks that allow only "simple" HTTP/1.1 over TLS 1.3, while HTTP/2/H3 segments are suspected or blocked.

Deep Dive

XHTTP Stream Architecture

1. TLS/TCP establishment. The client establishes a TCP (or TLS) connection. When TLS is used, uTLS is enabled to mimic a real browser (JA3, SNI, ALPN — usually http/1.1 plus optionally h2 for plausibility).
2. HTTP request. The client sends a plausible HTTP/1.1 request: a method (often POST or GET), a path (e.g., /api, /health, /v1/upload), headers (Host, User-Agent, Accept, Accept-Language, Content-Type, Connection: keep-alive, TE: trailers, Cache-Control, X-Requested-With, etc.). Two patterns are possible: a "long POST body" or an "Upgrade-like" exchange.
3. Server response. The server replies with 200/204/101 (depending on the pattern), proper server headers (Server: nginx, Date, Content-Type, Transfer-Encoding: chunked, Connection: keep-alive), and then keeps the connection open.
4. Tunnel. After that, both sides start exchanging the "useful" Xray protocol bytes hidden within the body/chunked segments. To the DPI, this is a live HTTP connection with a continuing body/chunks.

Key differences between XHTTP, HTTP/2, and WebSocket

• No explicit browser-level framing. H2/H3 are detectable via ALPN h2/h3, priorities, HPACK/QPACK. WS reveals Upgrade: websocket, Sec-WebSocket-Key/Accept headers. XHTTP uses "regular" headers.
• Fewer signatures. DPI is often trained to detect WebSocket and unusual HPACK profiles. XHTTP fits into the old, well-known HTTP/1.1 stack.
• Flexible false targets. It can convincingly imitate a downloader, uploader, long SSE, or slow API endpoint.
• Reliability in "noisy" networks. Simple HTTP/1.1 and chunked handling often work reliably behind corporate proxies and NATs.

Performance and overhead

• Header overhead: small but predictable; negligible impact over long sessions.
• RTT: one extra RTT for HTTP request/response beyond TLS handshake, reduced by keep-alive and early data (if supported).
• Throughput: comparable to plain TCP+TLS; bottlenecks are proxy/load balancer and buffering.

Compatibility and ALPN

In practice, ALPN set to "http/1.1" provides the most neutral profile. If the network prefers h2, you can add "h2" to the list, but the server must handle it correctly; otherwise, negotiation causes extra failures. For more realism, enable uTLS emulating recent Chrome/Firefox.

Practical Section 1: Minimal VLESS+XHTTP over TLS setup

Goal

Set up Xray with the VLESS protocol and XHTTP transport on 443/tcp with a valid certificate. Externally, host a regular website on the same domain or a static placeholder; proxy traffic goes through the XHTTP path.

Steps

1. Domain and DNS. Configure A/AAAA records pointing to your VPS. Make sure your IP isn’t on obvious blocklists.
2. Certificate. Install certbot or Caddy for automatic TLS. Minimize unnecessary ALPNs if you’re not using h2.
3. Xray. Update to the current 2026 version. Confirm that your build supports the XHTTP transport.
4. Server configuration. Create an inbound VLESS with streamSettings: network: xhttp, security: tls. Set up plausible headers and path.
5. Client configuration. Use the same network: xhttp, serverName, and path/host as the server. Enable uTLS.
6. Firewall. Allow 443/tcp and block unnecessary ports. Enable conntrack optimizations.
7. Verification. Run curl -v https://your_domain/path — you should get a genuine 200/204. Then check client connection and metrics in logs.

Example parameters (abridged)

Server: protocol: vless; clients: UUID; decryption: none; streamSettings: network: xhttp; security: tls; tlsSettings: serverName: your_domain; alpn: ["http/1.1"]; xhttpSettings: host: ["your_domain"], path: "/api", method: "POST", headers: {"User-Agent": ["Mozilla/5.0"], "Accept": ["* .related-articles { padding-top: 1rem; } .related-title { font-size: 1.75rem; font-weight: 700; color: var(--gray-900); margin-bottom: 1.5rem; padding-bottom: 0.75rem; border-bottom: 2px solid rgba(59,130,246,0.1); } .related-card { display: flex; flex-direction: column; gap: 0.5rem; height: 100%; background: white; border: 2px solid #e5e7eb; border-radius: 1rem; padding: 1.25rem 1.5rem; text-decoration: none; transition: all 0.3s cubic-bezier(0.4,0,0.2,1); box-shadow: 0 2px 8px rgba(0,0,0,0.04); } .related-card:hover { transform: translateY(-4px); box-shadow: 0 12px 24px rgba(59,130,246,0.15); border-color: var(--primary); } .related-card-title { font-size: 1.0625rem; font-weight: 600; color: var(--gray-900); line-height: 1.4; } .related-card-meta { font-size: 0.8125rem; color: #6b7280; display: flex; align-items: center; gap: 0.375rem; } .article-tldr { position: relative; margin: 0 0 2rem; padding: 1.25rem 1.5rem 1.25rem 1.75rem; background: linear-gradient(135deg, rgba(59,130,246,0.06), rgba(139,92,246,0.05)); border-start: 4px solid var(--primary); border-radius: 0.75rem; } .article-tldr-label { display: inline-block; font-size: 0.75rem; font-weight: 700; text-transform: uppercase; letter-spacing: 0.06em; color: var(--primary); margin-bottom: 0.4rem; } .article-tldr p { margin: 0; font-size: 1.0625rem; line-height: 1.6; color: #374151; font-weight: 500; } [data-bs-theme="dark"] .article-tldr { background: linear-gradient(135deg, rgba(59,130,246,0.10), rgba(139,92,246,0.10)); } [data-bs-theme="dark"] .article-tldr p { color: #e5e7eb; } [data-bs-theme="dark"] .article-tldr-label { color: #60a5fa; } .author-bio-extended { margin: 2rem 0; } .author-bio-card { background: linear-gradient(135deg, rgba(59,130,246,0.03), rgba(139,92,246,0.03)); border: 1px solid rgba(59,130,246,0.15); border-radius: 1.5rem; padding: 2rem; box-shadow: 0 4px 12px rgba(0,0,0,0.04); transition: all 0.3s; } .author-bio-card:hover { box-shadow: 0 8px 24px rgba(59,130,246,0.12); transform: translateY(-2px); } .author-bio-header { display: flex; align-items: center; gap: 1rem; margin-bottom: 1.5rem; padding-bottom: 1rem; border-bottom: 2px solid rgba(59,130,246,0.15); } .author-bio-icon { width: 48px; height: 48px; background: linear-gradient(135deg, var(--primary), var(--accent)); border-radius: 12px; display: flex; align-items: center; justify-content: center; box-shadow: 0 4px 12px rgba(59,130,246,0.3); } .author-bio-icon i { color: white; font-size: 1.25rem; } .author-bio-title { font-size: 1.5rem; font-weight: 700; color: var(--gray-900); margin: 0; } .author-bio-content { display: grid; grid-template-columns: 150px 1fr; gap: 2rem; align-items: start; } .author-photo-wrapper { position: relative; width: 150px; height: 150px; } .author-photo { width: 100%; height: 100%; object-fit: cover; border-radius: 1rem; border: 3px solid white; box-shadow: 0 8px 20px rgba(0,0,0,0.1); } .author-photo-badge { position: absolute; bottom: -8px; right: -8px; width: 36px; height: 36px; background: linear-gradient(135deg, var(--success), #059669); border-radius: 50%; display: flex; align-items: center; justify-content: center; border: 3px solid white; } .author-photo-badge i { color: white; font-size: 0.75rem; } .author-main-info { margin-bottom: 1rem; padding-bottom: 1rem; border-bottom: 1px solid rgba(0,0,0,0.08); } .author-name { font-size: 1.25rem; font-weight: 700; color: var(--gray-900); margin: 0 0 0.25rem; } .author-job { font-size: 0.9rem; color: var(--primary); margin: 0; font-weight: 500; } .author-info-list { display: flex; flex-direction: column; gap: 1rem; } .author-info-item { display: flex; gap: 1rem; align-items: flex-start; } .info-icon { width: 36px; height: 36px; min-width: 36px; background: rgba(59,130,246,0.08); border-radius: 8px; display: flex; align-items: center; justify-content: center; } .info-icon i { color: var(--primary); font-size: 0.875rem; } .info-content { font-size: 0.9rem; line-height: 1.5; } .info-content strong { display: block; font-size: 0.8rem; text-transform: uppercase; letter-spacing: 0.5px; color: #6b7280; margin-bottom: 0.25rem; } .expertise-tags { display: flex; flex-wrap: wrap; gap: 0.5rem; margin-top: 0.25rem; } .expertise-tag { padding: 0.25rem 0.75rem; background: rgba(59,130,246,0.08); color: var(--primary); border-radius: 1rem; font-size: 0.8rem; font-weight: 500; border: 1px solid rgba(59,130,246,0.15); } .achievements-list { margin: 0.25rem 0 0; padding-left: 1.25rem; } .achievements-list li { font-size: 0.9rem; margin-bottom: 0.25rem; } .author-bio-text { margin-top: 1rem; padding: 1rem; background: rgba(0,0,0,0.02); border-radius: 0.75rem; border-start: 3px solid var(--primary); } .author-bio-text p { margin: 0; font-size: 0.9rem; line-height: 1.6; color: #4b5563; } @media (max-width: 991px) { .article-content-card { padding: 2rem; } .article-title { font-size: 2rem !important; } .articleBody { font-size: 1rem; } .articleBody h2 { font-size: 1.75rem; } .articleBody h3 { font-size: 1.375rem; } } @media (max-width: 768px) { .article-content-card { padding: 1.5rem; border-radius: 1rem; } .article-title { font-size: 1.75rem !important; } .article-nav-title { font-size: 1rem; } .author-bio-content { grid-template-columns: 1fr; } .author-photo-wrapper { width: 100px; height: 100px; margin: 0 auto; } .info-icon { align-self: flex-start; } } [data-bs-theme="dark"] .article-search { background: #1f2937; border-color: rgba(255,255,255,0.1); color: #f9fafb; } [data-bs-theme="dark"] .article-search::placeholder { color: #9ca3af; } [data-bs-theme="dark"] .article-search:focus { border-color: var(--primary) !important; background: #1f2937; } [data-bs-theme="dark"] .article-content-card { background: #1f2937; border: 1px solid rgba(255,255,255,0.06); } [data-bs-theme="dark"] .article-title { color: #f9fafb !important; } [data-bs-theme="dark"] .article-meta { color: #9ca3af !important; } [data-bs-theme="dark"] .articleBody { color: #d1d5db; } [data-bs-theme="dark"] .articleBody h2, [data-bs-theme="dark"] .articleBody h3, [data-bs-theme="dark"] .articleBody h4 { color: #f9fafb; } [data-bs-theme="dark"] .articleBody a { color: #60a5fa; border-bottom-color: rgba(96,165,250,0.3); } [data-bs-theme="dark"] .articleBody a:hover { color: #93c5fd; border-bottom-color: #60a5fa; } [data-bs-theme="dark"] .articleBody blockquote { background: linear-gradient(135deg, rgba(59,130,246,0.1), rgba(139,92,246,0.1)); color: #d1d5db; } [data-bs-theme="dark"] .articleBody code { background: rgba(255,255,255,0.05); color: #f472b6; } [data-bs-theme="dark"] .articleBody pre { background: #111827; } [data-bs-theme="dark"] .article-nav-link { background: #1f2937; border-color: rgba(255,255,255,0.1); } [data-bs-theme="dark"] .article-nav-link:hover { border-color: rgba(59,130,246,0.5); } [data-bs-theme="dark"] .article-nav-direction { color: #60a5fa; } [data-bs-theme="dark"] .article-nav-title { color: #f9fafb; } [data-bs-theme="dark"] .author-bio-card { background: linear-gradient(135deg, rgba(59,130,246,0.08), rgba(139,92,246,0.08)); border-color: rgba(59,130,246,0.25); } [data-bs-theme="dark"] .author-bio-title, [data-bs-theme="dark"] .author-name { color: #f9fafb; } [data-bs-theme="dark"] .author-job { color: #60a5fa; } [data-bs-theme="dark"] .author-photo { border-color: #1f2937; } [data-bs-theme="dark"] .author-photo-badge { border-color: #1f2937; } [data-bs-theme="dark"] .author-main-info { border-bottom-color: rgba(255,255,255,0.1); } [data-bs-theme="dark"] .info-icon { background: linear-gradient(135deg, rgba(59,130,246,0.15), rgba(139,92,246,0.15)); } [data-bs-theme="dark"] .info-content { color: #d1d5db; } [data-bs-theme="dark"] .info-content strong { color: #f9fafb; } [data-bs-theme="dark"] .expertise-tag { background: linear-gradient(135deg, rgba(59,130,246,0.15), rgba(139,92,246,0.15)); color: #60a5fa; border-color: rgba(59,130,246,0.3); } [data-bs-theme="dark"] .author-bio-text { background: rgba(255,255,255,0.03); border-start-color: #60a5fa; } [data-bs-theme="dark"] .author-bio-text p { color: #d1d5db; } [data-bs-theme="dark"] .article-share-section h4 { color: #f9fafb; } [data-bs-theme="dark"] .related-title { color: #f9fafb; border-bottom-color: rgba(96,165,250,0.2); } [data-bs-theme="dark"] .related-card { background: #1f2937; border-color: rgba(255,255,255,0.1); } [data-bs-theme="dark"] .related-card:hover { border-color: rgba(59,130,246,0.5); } [data-bs-theme="dark"] .related-card-title { color: #f9fafb; } [data-bs-theme="dark"] .related-card-meta { color: #9ca3af; } body { background: #0A0E14 !important; } .breadcrumb { background: transparent !important; } .breadcrumb-item a { color: #8a94a6; } .breadcrumb-item.active { color: #6B7689 !important; } .breadcrumb-item + .breadcrumb-item::before { color: #4a5260 !important; } .article-content-card { background: transparent !important; border: 0 !important; box-shadow: none !important; } .article-title { color: #F5F6F7 !important; } .article-meta { color: #8a94a6 !important; } .article-meta i { color: #19E3B1 !important; } .article-search { background: #11161F !important; border: 1px solid rgba(245,246,247,.12) !important; color: #F5F6F7 !important; } .article-search::placeholder { color: #6B7689 !important; } .articleBody { color: #C5CAD3 !important; } .articleBody h2, .articleBody h3, .articleBody h4 { color: #F5F6F7 !important; } .articleBody h2 { border-bottom-color: rgba(245,246,247,.10) !important; } .articleBody a { color: #19E3B1 !important; border-bottom-color: rgba(25,227,177,.35) !important; } .articleBody a:hover { color: #3BEBC0 !important; border-bottom-color: #3BEBC0 !important; } .articleBody ul li::marker { color: #19E3B1 !important; } .articleBody blockquote { background: rgba(25,227,177,.05) !important; border-start-color: #19E3B1 !important; color: #aeb6c2 !important; } .articleBody code { background: rgba(25,227,177,.12) !important; color: #3BEBC0 !important; } .articleBody pre { background: #11161F !important; border: 1px solid rgba(245,246,247,.08) !important; color: #c2c9d4 !important; } .articleBody pre code { color: #c2c9d4 !important; } .articleBody img { box-shadow: 0 10px 34px rgba(0,0,0,.5) !important; } .article-tldr { background: rgba(25,227,177,.07) !important; border: 1px solid rgba(25,227,177,.22) !important; border-start: 3px solid #19E3B1 !important; } .article-tldr-label { color: #19E3B1 !important; } .article-tldr p { color: #c2c9d4 !important; } .article-share-section h4 { color: #F5F6F7 !important; } .article-nav-link, .related-card { background: #1A2230 !important; border: 1px solid rgba(245,246,247,.08) !important; box-shadow: none !important; } .article-nav-link:hover, .related-card:hover { border-color: rgba(25,227,177,.35) !important; box-shadow: 0 16px 40px -16px rgba(0,0,0,.6) !important; } .article-nav-direction { color: #19E3B1 !important; } .article-nav-title, .related-card-title, .related-title { color: #F5F6F7 !important; } .related-title { border-bottom-color: rgba(245,246,247,.10) !important; } .related-card-meta { color: #6B7689 !important; } .related-card-meta i { color: #19E3B1 !important; } .author-bio-card { background: #11161F !important; border-color: rgba(245,246,247,.08) !important; } .author-bio-header { border-bottom-color: rgba(245,246,247,.10) !important; } .author-bio-title, .author-name { color: #F5F6F7 !important; } .author-job { color: #19E3B1 !important; } .author-bio-icon { background: #19E3B1 !important; } .author-bio-icon i { color: #0A0E14 !important; } .author-main-info { border-bottom-color: rgba(245,246,247,.08) !important; } .author-photo { border-color: #1A2230 !important; } .info-icon { background: rgba(25,227,177,.12) !important; } .info-icon i { color: #19E3B1 !important; } .info-content { color: #c2c9d4 !important; } .info-content strong { color: #8a94a6 !important; } .expertise-tag { background: rgba(25,227,177,.10) !important; color: #19E3B1 !important; border-color: rgba(25,227,177,.22) !important; } .author-bio-text { background: rgba(255,255,255,.03) !important; border-start-color: #19E3B1 !important; } .author-bio-text p, .achievements-list li, .author-bio-content { color: #aeb6c2 !important; }