One address is enough. The server fetches the start page, picks up to three inner pages (a product, a category, a post) and runs a handful of probes: robots.txt, xmlrpc.php, the REST user list, ?author=1, readme.html, the upload directory, the http redirect and one CSS and one JS file. From that it derives what a WordPress or WooCommerce site could do better, scored and sorted by weight. The report is stored for 24 hours; after changes to the site, the button below the report runs it again and shows the difference.
Up to fourteen requests go from this server to the address entered, with a plain GET and no cookies. Requests to private networks, loopback and link-local addresses are refused, including through redirects. The query is protected by reCAPTCHA v3; the calling IP address and the target are stored for one hour to limit the rate (six fresh runs per hour). The report itself, containing only public facts about the site, is kept for 24 hours under a hash of the address.
Limit worth knowing: this reads the delivered HTML and headers and executes nothing. Images that a script inserts later, tags that load after consent and everything the browser measures at runtime (Largest Contentful Paint, layout shift) stay invisible. The report says where to look, not how fast the page feels.