shouldiuse.io

VERDICT

Should I use WebPageTest?

Free, open-source website speed testing with deep diagnostics - webpagetest.org

Worth it. Use it: the free tier delivers the deepest page-speed diagnostics available without paying. Skip it if you want a quick score or ongoing monitoring — that's PageSpeed Insights or Catchpoint territory.

Confidence

High. Based on 20+ public sources: G2, TrustRadius, Reddit, Kinsta, NVD, Rapid7, Catchpoint.

Ratings

  • Value for money
  • Ease of use
  • Feature depth
  • Support qualityNo support evidence found
  • Security posture

Pricing

$0

Starter

ModelNot disclosed
Monthly feesNot disclosed
HardwareNot disclosed
Free tierYes
Pro$18.75/mo
ExpertCustom

Best for

  • Developers debugging slow page loads
  • Performance engineers doing waterfall analysis
  • Teams fixing Core Web Vitals
  • QA needing scripted multi-step tests

Not for

  • Marketers wanting a quick score — use PageSpeed Insights
  • Teams needing uptime or real-user monitoring — this is lab testing only
  • Non-technical buyers who won't read waterfalls
  • Anyone expecting guaranteed SLA support on a free tool

Gotchas - check before you buy

high

Never expose a self-hosted instance publicly — old versions have a public Metasploit exploit.

medium

Free Starter plan limited to 300 monthly test runs; heavy API use pushes you to paid tiers.

medium

Pro (~$18.75/mo) is published but Expert/enterprise tiers are opaque; expect a sales conversation.

low

Owned by Catchpoint since 2020; the free tool's roadmap is tied to an enterprise vendor's strategy.

Pros and cons

Pros

  • Free tier includes 300 test runs per month
  • Self-described gold standard for web performance testing
  • Open source with a well-documented API for automation
  • Recommended 'hands down' as most reliable speed-test tool
  • Reproduces problems across locations, browsers, and devices

Cons

  • Lab testing only; real-user monitoring is a separate Catchpoint product
  • Results demand expert interpretation; beginners rely on third-party guides
  • Free plan capped at 300 monthly runs
  • Self-hosted instances have had serious vulnerabilities, including RCE

Sources & method

Analyzed 9/21/2026 - 12 sources - Historical CVEs (2012–2019) affect the open-source code, mostly self-hosted installs; no current incidents reported for hosted webpagetest.org.

official x2review x7security x2news x1
  • CVE-2019-12161, Vulnerability disclosed in WPO WebPageTest 19.04.
  • Arbitrary PHP file upload / RCE, Public Metasploit exploit module exists targeting WebPageTest instances.
  • 2017 XSS issues, CVE-2017-6534 and CVE-2017-6538: cross-site scripting issues in older versions.
  • Unauthorized access vulnerability, Documented access-control weakness; access controls advised.

Key stats

  • Value for money: 5/5

    Rating

  • $0

    Starting price

  • 12

    Sources

  • Analyzed

  • Value for money: 5/5. 300 free runs monthly; Pro $18.75
  • Ease of use: 3/5. Powerful output needs guides to interpret
  • Feature depth: 5/5. Waterfalls, filmstrips, scripting, API, global locations
  • Support quality. No support evidence found
  • Security posture: 2/5. Multiple historical CVEs, mostly self-hosted risk
  • ~4.5/5 G2 rating Catchpoint WebPageTest on G2
  • Yes Free tier 300 test runs/month
  • $18.75/mo Pro price entry paid plan
  • 2020 Acquired by Catchpoint

Pricing

Starter

$0

  • 300 monthly test runs
  • Core speed testing

Pro

$18.75/mo

  • Higher run volume
  • API access

Expert

Not disclosed

  • Synthetic + real-user monitoring combined
  • Enterprise-scale testing

Security

Historical CVEs (2012–2019) affect the open-source code, mostly self-hosted installs; no current incidents reported for hosted webpagetest.org.

  • CVE-2019-12161Vulnerability disclosed in WPO WebPageTest 19.04.⁹
  • Arbitrary PHP file upload / RCEPublic Metasploit exploit module exists targeting WebPageTest instances.10
  • 2017 XSS issuesCVE-2017-6534 and CVE-2017-6538: cross-site scripting issues in older versions.
  • Unauthorized access vulnerabilityDocumented access-control weakness; access controls advised.

What users say

Users overwhelmingly call it the most reliable, in-depth speed-testing tool available, though it skews technical.

“Webpagetest.org hands down.”
Reddit, r/Wordpress

Companies that use it

  • Snyk
  • Pressable
  • The Green Web Foundation
  • Annertech
Full analysis

Based on 20+ public sources: G2, TrustRadius, Reddit, Kinsta, NVD, Rapid7, Catchpoint.

Gold-standard deep page-speed diagnostics, free for light use; overkill for quick scores, and it does no real-user monitoring.

Methodology

Based on 20+ public sources: G2, TrustRadius, Reddit, Kinsta, NVD, Rapid7, Catchpoint.

Sources

  1. About WebPageTestwebpagetest.org
    official
  2. Catchpoint WebPageTest Pricing 2026 (G2)g2.com
    review
  3. WebPageTest Pricing 2026 (TrustRadius)trustradius.com
    review
  4. Top 10 Website Performance Tools (SearchAtlas)searchatlas.com
    review
  5. Guide to Using WebPageTest (Kinsta)kinsta.com
    review
  6. Website Performance testing with WebPageTest.org (PeakHour)peakhour.io
    review
  7. How To Use WebPageTest and its API (CSS-Tricks)css-tricks.com
    review
  8. Most reliable website testing tool (Reddit)reddit.com
    review
  9. CVE-2019-12161 (NVD)nvd.nist.gov
    security
  10. WebPageTest Arbitrary PHP File Upload (Rapid7)rapid7.com
    security
  11. Catchpoint to Acquire Webpagetest.orgcatchpoint.com
    news
  12. WebPageTest Expert Plan announcement (Catchpoint)catchpoint.com
    official

Rate this review

Anonymous. You can change your vote.

Loading votes…

Comments

One queue. No nested comments. Give a display name first. Limit: 200 words per comment and 7 comments per day. You can edit or delete yours.

Save a name to write a comment.

0 / 200 words

No comments yet.