modsecurity.org speed test — 20 Oct 2026
Measured from the wfix.shop server on 20 October 2026 at 14:15 UTC. Grade A (95/100), with the screenshots, the timings and the fixes that matter.
Where the first byte went
- DNS lookup 95 ms 29%
- TCP connect 33 ms 10%
- Server wait 201 ms 61%
Measured on the connection that fetched the HTML. Every other request on the page waits for the end of this bar before it can start.
How this page compares
Every report published here is in this comparison, so it is a reference population of pages tested from one server - not a benchmark of the whole web.
What these numbers mean
- The first byte arrived in 329 ms. That is workable, and the cheapest win left is caching or a warmer connection.
- The page transfers 259.5 KB over 23 request(s). Images files are 73% of it, so resize and recompress the largest images before anything else.
- The HTML itself arrives zstd-compressed.
- It runs over HTTP/3, so the assets share a connection instead of opening one each.
- The largest element painted at 480 ms, inside the 2.5 s Google calls good.
Fix first: Mobile viewport - Add a viewport meta tag with width=device-width and an initial scale of 1.
Read on one shared server, not a visitor's phone: use it to compare pages against each other, not as a promise about every connection. We fix what these tests find.
Screenshot
What the page looks like
Loaded in headless Chromium on this server. Click an image to open it full size.
Browser render
The same URL loaded in a real browser, so these are the readings curl cannot produce. The grade above is still built from the server measurements.
Page weight by type
What the page is made of
Transfer size, compressed as sent. 23 request(s) in total, 259.5 KB across all of them.
Top issues
Mobile viewport
medium impactNo viewport meta tag, so a phone renders the desktop layout scaled down.
Fix: Add a viewport meta tag with width=device-width and an initial scale of 1.
Strict-Transport-Security
low impactHSTS is not set, so the first visit on a hostile network can still be downgraded to HTTP.
Fix: Send Strict-Transport-Security with a max-age of at least six months. Add includeSubDomains once every subdomain is HTTPS.
Waterfall
Slowest requests
Each bar is one request's own response time, scaled to the slowest. Assets were fetched in parallel, so the bars overlap in real time rather than stacking. first party third party
| Request | Type | Status | Time | Size |
|---|---|---|---|---|
| https://modsecurity.org/apple-touch-icon.png | images | 200 | 1.51 s | 6.4 KB |
| https://modsecurity.org/js/partner-rotator.min.118b36697721979b2dcc6e1117bed7f3866acf20914349c29b3eb6f1f3c14f02.js | javascript | 200 | 1.30 s | 748 B |
| https://modsecurity.org/favicon-16x16.png | images | 200 | 1.29 s | 776 B |
| https://modsecurity.org/favicon-32x32.png | images | 200 | 1.25 s | 1.5 KB |
| https://modsecurity.org/img/social-icons/github.svg | images | 200 | 1.16 s | 788 B |
| https://modsecurity.org/images/logo/horizontal.png | images | 200 | 1.15 s | 46.0 KB |
| https://modsecurity.org/img/social-icons/linkedin.svg | images | 200 | 1.15 s | 542 B |
| https://modsecurity.org/favicon.ico | images | 200 | 1.15 s | 1.9 KB |
| https://modsecurity.org/css/styles.0a8417f48db2ece5968dff8ceb96ead60f095543230f323bb75177c9c192dab6e8683e6eed0bb6a8554bde70d8f24b1f7a014d124441500138eee3d62464a0f3.css | css | 200 | 1.14 s | 11.0 KB |
| https://modsecurity.org/images/owasp/logo.png | images | 200 | 1.14 s | 15.4 KB |
| https://modsecurity.org/img/social-icons/x.svg | images | 200 | 1.14 s | 266 B |
| https://modsecurity.org/fonts/nunito-v25-latin-700.woff2 | fonts | 200 | 1.13 s | 13.6 KB |
| https://modsecurity.org/fonts/nunito-v25-latin-800.woff2 | fonts | 200 | 1.13 s | 13.8 KB |
| https://modsecurity.org/images/modsecurity-shield-illustration.svg?v=shield-client-dadc46205411 | images | 200 | 1.10 s | 48.4 KB |
| https://modsecurity.org/img/social-icons/slack.svg | images | 200 | 1.10 s | 1.1 KB |
| https://modsecurity.org/img/partners-sprite.beb68ba986a3cb92a39809cdefbcf965c22fee4d7e14e606469d8d3457609ca7.svg | images | 200 | 1.08 s | 66.1 KB |
| https://modsecurity.org/fonts/nunito-v25-latin-regular.woff2 | fonts | 200 | 1.08 s | 13.7 KB |
| https://modsecurity.org/fonts/oswald-v49-latin-700.woff2 | fonts | 200 | 1.08 s | 9.9 KB |
| https://modsecurity.org/site.webmanifest | other | 200 | 1.07 s | 268 B |
| https://modsecurity.org/js/site-navigation.min.b3170236afb223b25c74699bbb76a32bc14197859c308d957e52819107459e47.js | javascript | 200 | 1.06 s | 925 B |
| https://modsecurity.org/js/matomo.min.44be3045a8b3241ca7af98307bc3a9a20aa56d27709d1014cadc12a3f35a1bee.js | javascript | 200 | 1.05 s | 291 B |
| https://modsecurity.org/cdn-cgi/scripts/5c5dd728/cloudflare-static/email-decode.min.js | html | 404 | 997 ms | 0 B |
Report this page
Run this test on your own site
The same engine, free, with the screenshots and the fixes. No account needed.