A lesson from running our own platform, in case it saves you an afternoon.
What happened. A custom REST endpoint on our site returned old data to some requests. The endpoint sent no-cache headers, and it still happened. Our host's edge cache (Kinsta) was caching anonymous GET responses to the REST API regardless of the Cache-Control header. It also cached a 404 from the same route, so a later authenticated request got the cached 404.
The fix. We switched the endpoints that must never be cached to POST. Edge caches do not store POST responses. We also send no-cache headers on every response path, including 404 and 500, and Vary: Authorization on routes that need a login.
How to check yours. Call the endpoint twice from a logged-out browser and compare the response headers. A cache HIT header on a GET you expected to be fresh is the tell.
Have you hit host caching on admin-ajax or the REST API? Reply with your host and what worked.
<p>A lesson from running our own platform, in case it saves you an afternoon.</p><p><strong>What happened.</strong> A custom REST endpoint on our site returned old data to some requests. The endpoint sent no-cache headers, and it still happened. Our host's edge cache (Kinsta) was caching anonymous GET responses to the REST API regardless of the Cache-Control header. It also cached a 404 from the same route, so a later authenticated request got the cached 404.</p><p><strong>The fix.</strong> We switched the endpoints that must never be cached to POST. Edge caches do not store POST responses. We also send no-cache headers on every response path, including 404 and 500, and Vary: Authorization on routes that need a login.</p><p><strong>How to check yours.</strong> Call the endpoint twice from a logged-out browser and compare the response headers. A cache HIT header on a GET you expected to be fresh is the tell.</p><p>Have you hit host caching on admin-ajax or the REST API? Reply with your host and what worked.</p>
