Use of `Cache-Control` should be flagged by Site Health for unauthenticated frontend responses due to preventing bfcache

[westonruter]

Browsers have typically prevented a page from being served from bfcache when is served with Cache-Control: no-store. For example, in Core-21938 this was done to prevent a cached page from being accessed after a user logs out of WordPress. However, there are many sites that serve Cache-Control: no-store even to unauthenticated requests. This is the number one reason for why bfcache is disabled in WP sites, as is seen at GoogleChromeLabs/wpp-research#75.

Chrome is currently experimenting with enabling bfcache when pages are served with Cache-Control: no-store, but there are scenarios still where such pages remain ineligible.

A Site Health test can be added which warns sites when they served unauthenticated responses with Cache-Control: no-store as this can make them ineligible for bfcache and thus negatively impact navigation performance.

[westonruter]

This may end up being important for Speculative Loading as well (h/t @yoavweiss):

Looks like Chromium is about to change how prefetches behave, so that only cacheable resources will be served from the prefetch cache: https://groups.google.com/a/chromium.org/g/blink-dev/c/Zdo71C0k9C0/m/BRXW6aQiAAAJ

If you're prefetching your HTMLs, make sure they are actually cacheable, even with a short lifetime.

[gilbertococchi]

That's an interesting insight, +1.

Also, if a WP Site uses Speculation Rules Prefetch or Prerender having BFCache working is particularly important in case of following back/forward navigations.

Speculation Rules is an API that works really well in combination with BFCache (not being blocked) and/or Cross Document View Transition.

[westonruter]

This may make sense to propose as part of the core merge for Speculative Loading since it if the Cache-Control header prevents Speculation Rules from working, then having the feature enabled in core would only wastefully increase server load without improving the user's navigation experience.

See Core-62503 and WordPress/wordpress-develop#7860.

cc @felixarntz

[westonruter]

Speculative Loading should also then be disabled automatically when a user is logged-in.

[westonruter]

Speculative Loading should also then be disabled automatically when a user is logged-in.

I've filed this as #1709.