Where Our Data Comes From: The Sources Behind a PerfoMetrix Report
A report is only as trustworthy as its sources. Most of what we check, we read ourselves from the page and its server; the rest comes from well-known public datasets and Google services. This guide lists them all, with what we ask each one and what it receives.
What we read ourselves
The page and its server. Our bot loads the page like a visitor, with at most 16 requests per scan: the page and its redirects, the http:// and www variants, robots.txt, the sitemap, security.txt, llms.txt, one made-up path to test the 404 page, and the favicon and share image the page names. From these we check headers, cookies, HTML, structured data, links and more.
The TLS handshake. We open one encrypted connection to read the certificate chain, the protocol version and the key strength. No HTTP request is sent over it.
Public DNS. We ask public resolvers (Cloudflare 1.1.1.1 and Google 8.8.8.8) for the domain’s mail and security records: MX, SPF, DKIM, DMARC, CAA, DNSSEC, MTA-STS and TLS-RPT.
Google services
PageSpeed Insights and Google Lighthouse. Google runs the current Lighthouse release on its servers and returns the lab metrics, the accessibility, SEO and best-practice audits, a screenshot and the page’s network log. Receives: the page address.
Chrome UX Report. Real-user timings from Chrome over the last 28 days, for the page or, when it has too few visits, for the whole site. Comes with the PageSpeed answer.
Google Web Risk. Google’s list of unsafe sites, the one browsers use to warn visitors. Receives: the page address and the third-party script and frame addresses the page loads.
Public datasets
- RDAP registries: when the domain was registered and when it expires (no owner details). Receives: the domain name.
- Tranco: a research ranking of popular websites, used for the “global rank”. We keep a copy; nothing is sent per scan.
- Chrome UX Report country lists: which countries a site is popular in, and our Top websites lists. Downloaded monthly.
- DB-IP Lite: the country and network of the server’s IP address, looked up in a local copy.
- endoflife.date and WordPress.org: whether the software versions a page shows are still supported. Receive: product names and plugin names, never your domain.
- Certificate transparency (crt.sh): how many hostnames have public certificates for the domain. Receives: the domain name.
- Common Crawl: whether the domain is in the newest open web crawl that many AI models learn from. Receives: the domain name.
- Public DNS blocklists: whether the server or mail server is listed for spam. Receive: the IP address in DNS form.
- Quad9: whether the domain is blocked as malicious. We resolve the domain through Quad9’s public resolver with threat blocking (9.9.9.9) and without it (9.9.9.10) and compare the answers. Receives: the domain name. We use Quad9’s public service like any other user; there is no partnership or agreement between PerfoMetrix and Quad9.
What we never do
- We don’t guess paths, send attack payloads, submit forms or download the page’s scripts.
- We don’t sell or share scan results, and reports are not listed anywhere.
- Third-party lookups can be switched off individually if a source fails or changes its terms.
Related guides
- What Google Lighthouse is explains the performance test in detail.
- Our bot page lists exactly what a scan requests and how to opt out.