Support · mod_pagespeed
Support from the engineers who build mod_pagespeed
What a subscription buys
- channel: direct
- Tickets and email go to the engineers who build the product. Nobody in between.
- response: by severity
- First-response targets per tier, on CET business days. Severity 1 (production down): within 8 business hours on Priority, 4 on Enterprise.
- security updates: advance notice
- We tell subscribers about a security release before it is published.
- scope: deployment or organization
- One production deployment in a declared server band, or a whole organization.
Subscriptions are governed by the support terms together with the terms of service.
Three tiers
Tiers differ in fleet size, response targets and what each adds. The software, and everything signed and attested, is the same in all three.
Standard support
€490 / year
up to 5 production servers
- Ticket and email channel to the engineers who build the product
- Configuration, upgrade and incident help
- Advance notice of security releases
- One onboarding configuration review
- First response within 2 business days
Priority support
Recommended€1,900 / year
up to 25 production servers
- Everything in Standard
- Vulnerability notifications timed to the EU Cyber Resilience Act reporting windows
- Upgrade rehearsal on request
- Quarterly review call
- Release SBOM and VEX on request
- First response next business day; severity 1 (production down) within 8 business hours
Enterprise
From €7,500 / year
unlimited servers and sites, one organization
- Everything in Priority
- A named engineer
- Custom build targets (distributions, nginx versions)
- Backports
- Master agreement, purchase order and invoice
- Roadmap input and consulting days
- Severity 1 (production down) within 4 business hours; other severities per agreement
A private package repository for Priority and Enterprise subscribers is being set up. Every signature and attestation is the same for every user, with or without a subscription.
Prices are per year, billed annually, excl. VAT. The price you sign at holds for one year. Existing customers keep their current rate; nobody is repriced mid-term. Response targets are first-response times. Support runs on CET business days, and business hours are CET.
For your security team
Signed packages and images
Every install of mod_pagespeed runs the same software from the same source, whatever the support tier. Here is what is signed today, for everyone.
What ships today, for everyone
-
The apt and yum repositories at
packages.modpagespeed.comare GPG-signed with the repository signing key (RSA 4096, fingerprintDF00 E296 BE91 41CE A541 1346 F50D 6054 F107 12A0); apt and dnf verify what they install against that key. -
Every release asset on GitHub is listed in a
SHA256SUMSfile published with the release. On the module's releases (from 2.5.0 on),SHA256SUMS.ascsigns that file with a separate key, the release signing key (fingerprint411D EFDB 5713 51D2 B25A EFCC 9C02 B5BD CCE7 5313; steps in Verifying a Release). The Windows installer is also Authenticode-signed by We-Amp B.V. -
An SPDX 2.3 SBOM, with a VEX document, is published in the
sbom/directory of the source tree. - The container images on GHCR are signed with keyless cosign and carry an SBOM attestation and build provenance; the verify commands are in the deployment guide.
Private package repository (being set up)
- A private package repository for Priority and Enterprise subscribers, planned to deliver security fixes before the public release, is being set up.
- Until then, Priority and Enterprise subscribers receive the release SBOM and VEX on request, and all subscribers get advance notice of security releases.
Everything is the same software under the Apache License 2.0. A subscription adds support, not a different license.
Ask about the private repositoryVerify what you install today
Two keys for two jobs. For the repositories: fetch the repository key, check its
fingerprint and pin apt to it. For files downloaded from a mod_pagespeed GitHub release:
fetch the release signing key, check its fingerprint, verify the signature on
SHA256SUMS against a keyring that holds only that key, then check the files
against it.
# apt and dnf repositories: the repository signing key
curl -fsSL https://packages.modpagespeed.com/pubkey.gpg -o modpagespeed.asc
gpg --show-keys --with-fingerprint modpagespeed.asc # expect DF00 E296 BE91 41CE A541 1346 F50D 6054 F107 12A0
gpg --dearmor < modpagespeed.asc | sudo tee /usr/share/keyrings/modpagespeed.gpg > /dev/null # apt: deb [signed-by=/usr/share/keyrings/modpagespeed.gpg] ...
# files from a mod_pagespeed GitHub release (2.5.0 on): the release signing key
curl -fsSLO https://raw.githubusercontent.com/We-Amp/mod_pagespeed/master/RELEASE-SIGNING-KEY.asc
gpg --show-keys --with-fingerprint RELEASE-SIGNING-KEY.asc # expect 411D EFDB 5713 51D2 B25A EFCC 9C02 B5BD CCE7 5313
gpg --dearmor < RELEASE-SIGNING-KEY.asc > release.gpg && gpgv --keyring ./release.gpg SHA256SUMS.asc SHA256SUMS && sha256sum --check --ignore-missing SHA256SUMS # macOS: shasum -a 256 --check --ignore-missing SHA256SUMS
On dnf, the
repository file
sets gpgcheck=1 against the same key.
An older key, fingerprint A358 2703 1804 5B75 C552 FEA8 DA8F EBD5 000B C194, signed
the 1.x direct downloads (per-file .asc) and the source tags v2.1.0 to
v2.4.0. It signs nothing new from 20 October 2026 and is being revoked: use it only to
check those older signatures, and treat any signature it made after that date as not ours.
Hosting partner program
For providers running mod_pagespeed across a multi-tenant fleet: Priority-level support for your second- and third-line team, plus cPanel/EA4 and distribution-channel upkeep. One agreement per provider, unlimited hosted domains.
The partner program →Consulting
When the question is your site rather than the software, We-Amp's consulting practice takes over: a fixed-price performance and configuration audit delivered as a written report, and longer engagements on caching and reverse-proxy infrastructure.
Consulting at we-amp.com →Already a customer?
IISpeed and mod_pagespeed 1.x license holders move to mod_pagespeed at no cost, and paid terms are honored to expiry. To transfer a license or renew into a support subscription, use the contact form with the topic “IISpeed license transfer” and include the order number or the email address the license was bought under. Existing customers keep their current rate when they move to a support subscription.
How to reach us
The contact form, or email info@we-amp.com. We reply within one business day (CET). Vulnerability reports go to security@modpagespeed.com under the security policy, never to the commercial address.
Support questions
Does a subscription change what the software does?
No. Every install runs the same software under the Apache License 2.0, with every optimization enabled by configuration, not by a plan. A subscription changes who answers when you need help. Once the private package repository for Priority and Enterprise is live, it will also change where those subscribers' packages come from.
Who answers a ticket?
The engineers who build mod_pagespeed. There is no first-line desk in front of them: the person reading your ticket can read the code path behind it.
When do you answer?
On CET business days. There is no 24x7 desk. First-response targets are per tier: Standard within 2 business days, Priority next business day, and severity 1 (production down) within 8 business hours on Priority and 4 business hours on Enterprise, with other Enterprise severities per agreement.
How do security updates reach me?
Everyone gets security fixes as regular releases through the channel they installed from, listed under Security in the release notes. Subscribers get advance notice, and Priority and Enterprise get vulnerability notifications timed to the EU Cyber Resilience Act reporting windows. A private package repository for Priority and Enterprise subscribers, planned to deliver security fixes before the public release, is being set up; until then, Priority and Enterprise subscribers can request the release SBOM and VEX.
What counts as a production server?
A server that serves production traffic with the module or the optimizer worker. You choose the band (up to 5, up to 25, or more) when you subscribe; there is no metering and the software never reports a count.
What is the private package repository?
A private package repository for Priority and Enterprise subscribers, planned to deliver security fixes before the public release, is being set up. Until then, Priority and Enterprise subscribers receive the release SBOM and VEX on request, and all subscribers get advance notice of security releases. Packages in it will carry the same license as the standard packages.
What is signed today?
The apt and yum repositories are GPG-signed with the repository signing key. From 2.5.0 on, each mod_pagespeed GitHub release carries one signature, SHA256SUMS.asc, made with a separate release signing key over the SHA256SUMS file that lists every release file; the release files carry no per-file .asc signatures. The Windows installer is Authenticode-signed by We-Amp B.V. The optimizer worker's release assets on GitHub carry no signature; every one is listed in SHA256SUMS. The container images are cosign-signed and carry an SBOM attestation and build provenance. Release SBOM and VEX documents are available to Priority and Enterprise subscribers on request. Everything is the same software under the Apache License 2.0. See signed packages and images.
Can I verify the standard packages without a subscription?
Yes. The apt and yum repositories are GPG-signed, every release asset is listed in SHA256SUMS, the mod_pagespeed releases sign that file from 2.5.0 on, and the SPDX SBOM and OpenVEX file are published in the source tree. The recipe on this page checks both keys, the signature and the checksums.
What happens if a subscription lapses?
Nothing happens to your deployment. The software keeps running and you keep upgrading from the public channels. Write to info@we-amp.com when you want to pick it up again.