VulScoreWEBSITE SECURITY

Website security. Clearly measured.

SECURITY · SSL · PERFORMANCE

Scan your website’s performance

Measure your document’s response time and size, then review compression, redirects, and caching.

Public HTTP and HTTPS websites. One document, up to five redirects, ten-second limit.

SAMPLE REPORT · ILLUSTRATIVE DATA

Performance results

https://demo.example/

04 Nov 2026 · 17:03 UTC

This is a demonstration using fabricated measurements. No request was sent to this domain.

940 msTime to final response headers
28.0 KiBFinal document transfer body
1,120 msTime to document downloaded
2Redirects followed

One server-side measurement, including network setup and redirects. This is not browser load time, Lighthouse, or Core Web Vitals. Images, scripts, styles, and fonts are not fetched; page rendering and user interactions are not measured.

Time to response headers:Review

What we observed

Final response headers arrived after 940 ms, including DNS, connections, TLS, and redirects. The advisory budget here is 800 ms.

What to improve

Repeat measurements from relevant regions. Investigate slow backend work, unnecessary redirects, and CDN or page-cache opportunities. This measures complete headers, not browser TTFB or a Core Web Vital.

Redirect overhead:Review

What we observed

2 redirects preceded the final response.

What to improve

Link directly to the canonical HTTPS address and avoid redirect chains. Keep necessary HTTP-to-HTTPS redirects.

Document caching policy:Context needed

What we observed

Observed: no-cache

What to improve

This policy may be correct for private, personalised, or frequently changing HTML. Never make sensitive pages publicly cacheable just to improve performance.

Response received:Pass

What we observed

HTTP 200, protocol HTTP/1.1. The requested document was received.

What to improve

Verify that the final address and response match the page your visitors receive. This scan fetches one document and follows up to five redirects.

Document weight:Pass

What we observed

Downloaded 28.0 KiB of final-response body. Decoded document: 180.0 KiB. The advisory HTML budget is 200 KiB; assets are not included.

What to improve

Remove unnecessary markup and oversized embedded data. Check JavaScript, styles, fonts, and image sizes in a browser waterfall; they are not downloaded by this scanner.

Response compression:Pass

What we observed

The server returned Content-Encoding: br after gzip and Brotli were offered. Body size reduced by 84% versus the decoded document.

What to improve

Enable gzip or Brotli for compressible text where appropriate. A compressed response is not proof that every asset is compressed.

Cache revalidation:Pass

What we observed

An ETag or Last-Modified validator was returned; conditional requests were not tested.

What to improve

For cacheable content, provide validators so unchanged resources can be reused. Validators are unnecessary for no-store responses.

Compression cache variation:Pass

What we observed

Vary: Accept-Encoding

What to improve

When response compression is negotiated, use Vary: Accept-Encoding so caches distinguish encodings. Review CDN-specific cache configuration too.

Reports are not saved. Use your browser’s Print / Save as PDF to keep this result.

Timing, with context

Timings come from this scanner’s network location. Repeat scans to distinguish persistent delays from normal variation. A quick HTML response does not guarantee a fast rendered page.

Smaller documents

Compare transferred and decoded document sizes. The scanner offers gzip and Brotli and checks how the server varies compressed responses for caches.

Cache appropriately

Caching advice considers private and no-store responses. Sensitive pages should stay private; performance should not compromise confidentiality.

Learn about HTTP caching