Use of Cache-Control: no-store should be flagged by Site Health for unauthenticated frontend responses

[westonruter]

Browsers have typically prevented a page from being served from bfcache when is served with Cache-Control: no-store. For example, in Core-21938 this was done to prevent a cached page from being accessed after a user logs out of WordPress. However, there are many sites that serve Cache-Control: no-store even to unauthenticated requests. This is the number one reason for why bfcache is disabled in WP sites, as is seen at GoogleChromeLabs/wpp-research#75.

Chrome is currently experimenting with enabling bfcache when pages are served with Cache-Control: no-store, but there are scenarios still where such pages remain ineligible.

A Site Health test can be added which warns sites when they served unauthenticated responses with Cache-Control: no-store as this can make them ineligible for bfcache and thus negatively impact navigation performance.