Plan mode is the safe default and sends no requests. Run mode is limited to 20 GET/HEAD requests, concurrency 5, HTTPS public hosts, no credentials/query/body, and a five-second disposable Worker. Confirm authorization only for infrastructure you own or are explicitly permitted to test. Browser CORS and connection limits still apply. Response bodies are discarded; no input or report is saved.
1–20 requests per run.
1–5 requests in flight.
100–1,500 ms per request.
Required for run mode. Unauthorized load generation may be illegal.