Web Services Security (WSS) has been approved as a standard by OASIS and widely adopted in the industry as a solution for enhancing the security of web services. However, the performance of WSS remains a concern due to the additional security contents added to SOAP message and the extra service time for processing these security contents. This paper aims at clarifying this concern by conducting a performance evaluation of WSS. A simple web service is designed and used for performance testing with a variety of WSS polices and message sizes. The test results are categorized, compared and analyzed to work out the overheads for individual security setting. This work is expected to provide an overview and guidance for WSS performance overhead.