A working tool I built: type a web address and it runs Google PageSpeed Insights, the same public test anyone can use. No sign-up, and scores are kept for a day, not your details.
A Cloudflare Pages Function calls Google PageSpeed Insights so the API key never reaches the browser.
URLs are normalised to origin only, which closes off cache poisoning and SSRF-style path tricks.
Results cache for 24 hours in KV; per-IP and global hourly caps keep the free API quota honest.
Google's tester is cut off at 55 seconds so heavy sites get a clean answer instead of an edge error page.