Husain Parvez
JMeter can generate HTTP Request samplers by acting as a local recording proxy between a browser and an authorized target application. Current versions call this component the HTTP(S) Test Script Recorder. It captures one browser journey into a Recording Controller, after which the script must be cleaned, correlated, validated, and executed as a protocol-level test.
What is the JMeter HTTP Proxy Server?
The recorder listens on a local port, commonly 8888. A browser sends HTTP and HTTPS requests to that proxy, and JMeter converts matching traffic into samplers under a selected controller. During replay, JMeter sends requests directly; it does not launch a browser for every virtual user.
Why Record Instead of Building the Script by Hand?
- Captures realistic request order, redirects, forms, and background APIs.
- Reveals XHR or fetch calls that are easy to overlook.
- Creates a quick baseline for a complex user journey.
- Reduces transcription errors in headers and parameters.
Manual construction remains cleaner for a small documented API. Recording helps when browser network behavior is not yet understood. For terminology, see our proxy types guide.
How to Record a Script in JMeter 5.x
- Start JMeter in GUI mode for script creation.
- Add a Thread Group to the Test Plan.
- Add a Recording Controller under the Thread Group.
- Add HTTP Request Defaults and an HTTP Cookie Manager where appropriate.
- Add the HTTP(S) Test Script Recorder and select the Recording Controller as its target.
- Use include/exclude patterns to limit unrelated traffic.
The official Apache JMeter recording guide is the authoritative version-specific reference.
Step 1) Setting the HTTP Proxy server
8888, set the target controller, and click Start.Configure the test browser with HTTP and HTTPS proxy host 127.0.0.1 and the same port. If the browser runs in another VM or container, localhost refers to that environment; use an approved reachable private address instead.
Proxy host: 127.0.0.1
Proxy port: 8888
Include: https?://test.example.com/.*
Exclude: .*(.png|.jpg|.gif|.css|.woff2)(?.*)?$Do not filter too aggressively on the first pass because an application API may use another subdomain. Record once, inspect the hosts, then refine the patterns.
Step 2) Record your activity
- Start the recorder and trust its temporary certificate only in the isolated test browser.
- Open the authorized test environment.
- Perform one clean journey at human speed.
- Stop recording immediately after the final business action.
- Restore the browser’s normal proxy setting.
Rename samplers by business action and group related requests under Transaction Controllers. Remove analytics, ads, browser updates, chat widgets, and duplicate static resources unless they are explicitly in scope.
Inspect every sampler for secrets. Passwords should come from protected runtime data, while changing tokens require correlation.
Step 3) Run your Test Plan
Validate one user and one iteration before adding load. Temporarily use View Results Tree, check redirects and response bodies, and add assertions for the expected business outcome. HTTP 200 alone does not prove that login or checkout succeeded.
Threads: 1
Ramp-up: 1 second
Loop Count: 1After debugging, remove heavy listeners and run non-GUI:
jmeter -n -t recorded-test.jmx -l results.jtl -e -o html-reportThe report directory must be new or empty. Increase load gradually and monitor the target system as well as JMeter.
Step 4) Save your test result
Save the reusable plan as a .jmx file and keep generated data separate:
- JMX: samplers, controllers, assertions, timers, variables, and configuration.
- JTL: raw sample results for analysis.
- HTML dashboard: percentiles, throughput, errors, and active threads.
- Server metrics: CPU, memory, database, queue, and service telemetry.
Version the plan with non-secret properties and test data. Record JMeter and Java versions, target build, environment, user count, ramp-up, and duration.
Recording HTTPS Traffic and Certificates
For HTTPS, JMeter generates a temporary certificate authority when the recorder starts. Import it only into the dedicated test browser, record the authorized site, then remove it.
- Start the HTTP(S) Test Script Recorder.
- Locate the generated ApacheJMeterTemporaryRootCA certificate.
- Import it as a trusted authority in the isolated profile.
- Record the approved HTTPS journey.
- Remove the certificate when finished.
Certificate pinning, mutual TLS, managed browsers, mobile apps, and newer transport protocols can block interception. Do not weaken production security controls. Use a staging build, API specification, or approved alternate capture method.
Correlation: Making a Recorded Script Replayable
Session IDs, CSRF tokens, OAuth state, request signatures, and resource IDs change between runs. Correlation extracts a fresh value from one response and substitutes it into later requests.
- Locate the response that first contains the dynamic value.
- Add a JSON, CSS, XPath, or Regular Expression Extractor.
- Store the result in a named JMeter variable.
- Replace later hard-coded values with the variable reference.
- Fail clearly when extraction returns no match.
JSON Extractor
Variable: csrfToken
JSON Path: $.csrf.token
Default: NOT_FOUND
Later header:
X-CSRF-Token: ${csrfToken}Parameterization supplies independent user data, often from CSV. Correlation captures server-generated data during execution. Realistic plans usually need both.
Troubleshooting
| Problem | Likely cause | Fix |
|---|---|---|
| No requests recorded | Wrong proxy, stopped recorder, port conflict, or bypass rule | Confirm host and port, start the recorder, and remove target exclusions. |
| HTTPS warning | Temporary CA missing or expired | Generate a fresh recorder certificate and import it only into the test profile. |
| Too much traffic | Extensions, telemetry, other tabs, or broad patterns | Use a clean profile and refine include/exclude filters. |
| Login replay fails | Missing cookies, tokens, OAuth flow, or correlation | Add Cookie Manager, extract dynamic values, and inspect redirects. |
| Browser offline afterward | It still points to the stopped local proxy | Restore automatic or no-proxy settings. |
| JMeter memory error | GUI listeners or large response storage | Use non-GUI mode and limit saved response data. |
| Different from browser | JMeter does not render or execute page JavaScript | Test underlying APIs and use browser tooling for rendering metrics. |
JMeter is a protocol performance tool. It cannot measure visual events such as Largest Contentful Paint by itself.
FAQs
What replaced the HTTP Proxy Server name in JMeter?
The component is now called HTTP(S) Test Script Recorder.
What recorder port should I use?
Any unused local port works. Port 8888 is common, and the browser must use the same value.
Can JMeter record HTTPS traffic?
Yes, when the isolated test browser trusts JMeter’s temporary recording certificate.
Why does a recorded script fail on replay?
Dynamic tokens, cookies, authentication flows, host differences, and missing data commonly require correlation and parameterization.
Can JMeter record Chrome?
Yes. Configure a clean Chrome profile to use JMeter’s local recorder.
Should I run load tests from the JMeter GUI?
No. Build and debug in GUI mode, then execute load in non-GUI mode.
Does JMeter behave like a real browser?
No. It sends protocol requests but does not render HTML or execute browser JavaScript.
Is it safe to record a production login?
Prefer staging and test accounts. Production capture requires explicit authorization and strict secret handling.