Send no-cache response header from wp-cron.php requests

[westonruter]

In high-scale WordPress installs, it is common to enable DISABLE_WP_CRON and then have a system cron ping wp-cron.php?doing_wp_cron every minute. When working on a site with DISABLE_WP_CRON, we recently ran into a situation where future-published posts were consistently missing their schedule for several minutes. It turns out that the network architecture routed requests through Pound and then Varnish before hitting the web server, including requests originating on the server itself.

Because of the default proxy cache configuration, the requests to wp-cron.php were getting served from the cache without hitting WordPress, so the scheduled tasks were not getting executed. A workaround was put in place to add a timestamp cache-buster (i.e. wp-cron.php?doing_wp_cron&1283712312), and then we worked out a more elegant solution with a mu-plugin which did nocache_headers() if DOING_CRON. It seems the best solution is to just always send no-cache headers from wp-cron.php itself, as I can't imagine a situation where responses should be cached (except maybe with a max-age=60).

In addition to the default no-cache headers that WordPress sends, we also included a Surrogate-Control: no-cache header for caching proxies to specifically target.

So to summarize: I propose that wp-cron.php send no-cache response headers.

[westonruter]

Patch to wp-cron.php to do nocache_headers()

[westonruter]

Come to think of it, the DISABLE_WP_CRON may be inconsequential here: the normal asynchronous wp-cron.php loopback requests would also likely be subject to the proxy caching.

[westonruter]

mu-plugin to send no-cache response headers from wp-cron.php

[mordauk]

I don't know of any reason this would cause issues. Seems like a good idea to me.

[nacin]

What if you just used a POST request instead?

[westonruter]

Replying to nacin:

What if you just used a POST request instead?

Note we can't just send an arbitrary POST request: it would have to explicitly be a POST request without any post data because wp-cron.php short-circuits if $_POST is not empty:

if ( !empty($_POST) || defined('DOING_AJAX') || defined('DOING_CRON') )
	die();

[jrf]

@westonruter's suggestion & patch make sense to me. What needs to be done to move this forward ?

[peterwilsoncc]

This seems sensible to me, the patch requires a refresh:

• Reference to DISABLE_WP_CRON can eb removed
• The comment needs to be converted to a docblock.

[johnbillion]

This got fixed in #47396 for 5.3.