WordPress / performance

Performance plugin from the WordPress Performance Group, which is a collection of standalone performance modules.
https://wordpress.org/plugins/performance-lab/
GNU General Public License v2.0
367 stars 101 forks source link

Use of `Cache-Control: no-store` should be flagged by Site Health for unauthenticated frontend responses #1692

Open westonruter opened 1 day ago

westonruter commented 1 day ago

Browsers have typically prevented a page from being served from bfcache when is served with Cache-Control: no-store. For example, in Core-21938 this was done to prevent a cached page from being accessed after a user logs out of WordPress. However, there are many sites that serve Cache-Control: no-store even to unauthenticated requests. This is the number one reason for why bfcache is disabled in WP sites, as is seen at https://github.com/GoogleChromeLabs/wpp-research/pull/75.

Chrome is currently experimenting with enabling bfcache when pages are served with Cache-Control: no-store, but there are scenarios still where such pages remain ineligible.

A Site Health test can be added which warns sites when they served unauthenticated responses with Cache-Control: no-store as this can make them ineligible for bfcache and thus negatively impact navigation performance.