If it isn’t already, GTmetrix should be your go to for a quick performance review. It doesn’t test load but is great for getting that single user view of any issues that may be effecting performance as well as some timings. You really should do more, see The Art of WordPress load testing, where I discuss GTmetrix and solutions like Supervisor for the full monty of testing.
You don’t need an intergalactic bounty hunter to fight bad guys. iThemes Security Pro will secure and protect your WordPress sites from the wretched hive of scum and villainy across the internet! Prevent hacks, security breaches, malware and more. This is the way.
The big update to GTmetrix means that PageSpeed/YSlow is no longer part of the equation when getting your performance score. Lighthouse is an open source tool developed by Google to more accurately reflect how a user experiences website loading. This is really really important for sites using lazy loading. The best example is WordPress.com, which used to report times of 10 seconds or more to load (which if you’ve ever gone there is patently false), now GTmetrix reports a much more accurate experience of 1.2 seconds. WPMUDEV does a good rundown of all the details in the report, How To Check WordPress Site Speed With The New GTmetrix: “[GTmetrix] provides an assessment of webpages focused on the pages’ user experience and tracks the timing of various milestones that users actually experience and care about, then scores each of these metrics in three key areas.”