SlowFinder

Manual. It profiles your own browser visit, which passes Cloudflare like any normal human visit, so no challenged loopback request is involved.

Open the page while logged in to the same site in that browser. Logged-in requests bypass full-page caches (Cloudflare and host) so PHP actually runs and can be profiled. If your edge cache serves the page without hitting PHP, nothing can be measured.

They are inflated on purpose: adding a timer to every hook callback adds overhead, so totals run higher than a real visit. Use the ranking and the "share of measured time" column to find the offender, not the absolute figures.

It measures time spent in hook callbacks (where most front-end overhead lives: enqueuing assets, template_redirect, the_content, queries, wp_head/wp_footer). Time spent purely including a plugin's files before any hook runs is not counted.

Profiling only happens during a scan you trigger, gated by a one-time token or a cookie that only exists in your browser for ten minutes. Normal visitors are never profiled.