Securealy
Check · Performance · low · passive

Time to first byte under 800 ms

The HTML response starts within 800 ms.

Severity
low
Tier
Passive: runs on any URL
Category
Performance
Fix
Summary below; full runbook in the Fix Kit, Module 01: Ship it
Id
ttfb

What this means

Passing means the first byte of your home page's HTML reaches us within 800 ms of the request. Failing means the origin took longer than that to begin answering. This measures the server, not the page: a heavy page with a fast origin passes, a light page with a slow origin fails.

How we test it

We request the home page once, following redirects, and time the gap between sending the request and receiving the first byte of the final response. Under 800 ms passes. Over 800 ms fails. A single measurement from one location is a coarse test, so a site near the line can score differently on two runs.

Why it matters

Slow origins hurt ranking and conversion. Every other asset on the page waits behind the HTML, so a slow first byte delays everything that follows it, including the first paint. On a static or edge-served site the first byte is fast by default; a slow one usually means the page is rendered on every request, waits on a database before it sends anything, or is served from a single region far from the visitor.

The fix

Serve the home page as static or cached output rather than rendering it on every request, and move any database or API call it waits on out of the response path or behind a cache, so the HTML is sent before any slow work starts. Confirm with curl -s -o /dev/null -w '%{time_starttransfer}\n' https://YOUR_DOMAIN/, expected a value under 0.800. The full runbook is in the Fix Kit, Module 01.

Prompt for your AI

Paste this into the coding agent that built the app. It reproduces the finding and stops before changing anything; the fix steps are in the kit.

Do not change anything. This is a verification pass.
Run: curl -s -o /dev/null -w 'dns %{time_namelookup} connect %{time_connect} tls %{time_appconnect} firstbyte %{time_starttransfer} total %{time_total}\n' https://YOUR_DOMAIN/ and show me the output.
Run it three times, at least ten seconds apart, and show me all three lines. Do not loop beyond that.
Tell me whether the home page is served as a static file, a cached render, or rendered on every request, and where in the code that is decided.
List every database or network call the home page makes before it responds, with the file and line.
List what it would take to send the HTML before that work runs, and stop there.
Run: curl -s -o /dev/null -w '%{time_starttransfer}\n' https://YOUR_DOMAIN/ and show me the output. Expected on a passing site: a value under 0.800.

Next

Grade your own URL

Every grade lists this check with its evidence for your site. Two free grades a day.