| @@ -229,27 +229,36 @@ | ||
| 229 | 229 | // about") instead of the WARN the block deserves. |
| 230 | 230 | $inconclusive = $inconclusive && ! $refused; |
| 231 | 231 | |
| 232 | 232 | if ( Server::NGINX === $server_type ) { |
| 233 | - if ( $is_active ) { | |
| 234 | - $nginx_detail = 'nginx is serving cache hits directly — PHP bypassed (~5-15ms TTFB).'; | |
| 235 | - } elseif ( 'mobile_separate' === $block_reason ) { | |
| 236 | - $nginx_detail = 'nginx detected, but the static rewrite is disabled because Separate Mobile Cache is on.' . $mobile_block; | |
| 237 | - } elseif ( 'skipped_nonce' === $block_reason ) { | |
| 238 | - $nginx_detail = self::nonce_skip_detail( $skip ); | |
| 239 | - } elseif ( $inconclusive ) { | |
| 240 | - $nginx_detail = sprintf( | |
| 241 | - 'Could not verify the static rewrite — the check itself did not complete, so this is not evidence that your config is wrong. If you have already pasted the snippet, it may well be working. Reason: %s', | |
| 242 | - $probe_reason | |
| 243 | - ); | |
| 244 | - } else { | |
| 245 | - $nginx_detail = 'nginx detected but not yet routing to the cache. Paste the snippet below into your site\'s server { } block, then reload nginx.'; | |
| 233 | + // One verdict for both surfaces: this panel and the Site | |
| 234 | + // Health test must answer from the SAME ordering, or they | |
| 235 | + // drift apart again — the whole point of #480. | |
| 236 | + $verdict = \XSpeed\Modules\Health\HealthModule::nginx_rewrite_verdict( $probe, $block_reason ); | |
| 237 | + switch ( $verdict ) { | |
| 238 | + case 'active': | |
| 239 | + $nginx_detail = 'nginx is serving cache hits directly — PHP bypassed (~5-15ms TTFB).'; | |
| 240 | + break; | |
| 241 | + case 'mobile_separate': | |
| 242 | + $nginx_detail = 'nginx detected, but the static rewrite is disabled because Separate Mobile Cache is on.' . $mobile_block; | |
| 243 | + break; | |
| 244 | + case 'skipped_nonce': | |
| 245 | + $nginx_detail = self::nonce_skip_detail( $skip ); | |
| 246 | + break; | |
| 247 | + case 'unverified': | |
| 248 | + $nginx_detail = sprintf( | |
| 249 | + 'Could not verify the static rewrite — the check itself did not complete, so this is not evidence that your config is wrong. If you have already pasted the snippet, it may well be working. Reason: %s', | |
| 250 | + $probe_reason | |
| 251 | + ); | |
| 252 | + break; | |
| 253 | + default: // 'required'. | |
| 254 | + $nginx_detail = 'nginx detected but not yet routing to the cache. Paste the snippet below into your site\'s server { } block, then reload nginx.'; | |
| 246 | 255 | } |
| 247 | 256 | |
| 248 | 257 | $out[] = array( |
| 249 | 258 | 'id' => 'static_rewrite_nginx', |
| 250 | 259 | // Inconclusive is INFO, not WARN — we have no finding to warn about. |
| 251 | - 'tone' => $is_active ? self::OK : ( $inconclusive ? self::INFO : self::WARN ), | |
| 260 | + 'tone' => 'active' === $verdict ? self::OK : ( 'unverified' === $verdict ? self::INFO : self::WARN ), | |
| 252 | 261 | 'label' => 'Static-file rewrite (nginx server config)', |
| 253 | 262 | 'detail' => $nginx_detail, |
| 254 | 263 | // Always ship the snippet — even when active, so the |
| 255 | 264 | // admin has it handy for re-pasting after a server |
| @@ -322,8 +331,62 @@ | ||
| 322 | 331 | ); |
| 323 | 332 | } |
| 324 | 333 | } |
| 325 | 334 | |
| 335 | + /* | |
| 336 | + * A full-page cache owned by the WEB SERVER, in front of PHP. | |
| 337 | + * | |
| 338 | + * Reported only when it is actually there, because it is a fact about | |
| 339 | + * the host rather than a setting the admin can act on from here — an | |
| 340 | + * "absent" row would be noise on the ~99% of sites that have no such | |
| 341 | + * layer. When it IS there it outranks almost everything else on this | |
| 342 | + * panel: nginx answers before WordPress runs, so what a visitor sees | |
| 343 | + * is decided by that cache and not by anything xSpeed reports about | |
| 344 | + * its own. | |
| 345 | + * | |
| 346 | + * The severity is about DOUBLE full-page caching, not about the layer | |
| 347 | + * existing. Two independent full-page caches stacked in front of one | |
| 348 | + * site have independent TTLs, and the outer one can re-serve HTML the | |
| 349 | + * inner one has already regenerated — the classic "I purged and it is | |
| 350 | + * still stale" report. With xSpeed's own page cache off there is only | |
| 351 | + * one layer and nothing to warn about, so that case is INFO. | |
| 352 | + */ | |
| 353 | + $host_cache_path = Host_Page_Caches::nginx_helper_cache_path(); | |
| 354 | + if ( null !== $host_cache_path ) { | |
| 355 | + $detail = $cache_enabled | |
| 356 | + ? 'Your server is running its own full-page cache in nginx (FastCGI), managed by the Nginx Helper plugin your host installed — so this site has TWO full-page caches stacked in front of it. xSpeed forwards every Purge All to the server layer, but the two expire on their own schedules (the server side is typically an hour), so a page can still be served from nginx after xSpeed has regenerated it. If edits keep looking stale, purge from your host\'s dashboard too, or turn xSpeed\'s page cache off and let the server layer do the work — it is the faster of the two, because it answers before PHP starts.' | |
| 357 | + : 'Your server is running a full-page cache in nginx (FastCGI), managed by the Nginx Helper plugin your host installed. xSpeed\'s own page cache is off, so this is the only full-page cache in front of the site — and it is the fastest kind, answering before PHP starts. Purge All in xSpeed still clears it.'; | |
| 358 | + | |
| 359 | + // Path prefix as a fingerprint for the WORDING only — never as a | |
| 360 | + // gate. Nginx Helper is not xCloud-only; other hosts and manual | |
| 361 | + // installs use it with a cache directory somewhere else entirely. | |
| 362 | + if ( 0 === strpos( $host_cache_path, '/etc/nginx/cache/' ) ) { | |
| 363 | + $detail .= sprintf( ' Cache directory: %s (the layout xCloud provisions).', $host_cache_path ); | |
| 364 | + } else { | |
| 365 | + $detail .= sprintf( ' Cache directory: %s.', $host_cache_path ); | |
| 366 | + } | |
| 367 | + | |
| 368 | + // The purge is a direct unlink by the PHP-FPM user against a | |
| 369 | + // directory nginx owns. Whether that user can write there is a | |
| 370 | + // property of the host we cannot test from here without deleting | |
| 371 | + // someone's cache to find out, so say what to check rather than | |
| 372 | + // claiming an outcome either way. | |
| 373 | + if ( 'unlink_files' === Host_Page_Caches::nginx_helper_purge_method() ) { | |
| 374 | + $detail .= ' The server cache is purged by deleting its files directly, which needs PHP to have write access to that directory — if a purge here never changes what nginx serves, that permission is the thing to check with your host.'; | |
| 375 | + } | |
| 376 | + | |
| 377 | + if ( is_multisite() ) { | |
| 378 | + $detail .= ' On multisite, nginx keys one cache per install rather than per site, so this purge clears every site on the network.'; | |
| 379 | + } | |
| 380 | + | |
| 381 | + $out[] = array( | |
| 382 | + 'id' => 'host_page_cache', | |
| 383 | + 'tone' => $cache_enabled ? self::WARN : self::INFO, | |
| 384 | + 'label' => 'Server-level page cache (nginx FastCGI)', | |
| 385 | + 'detail' => $detail, | |
| 386 | + ); | |
| 387 | + } | |
| 388 | + | |
| 326 | 389 | // Cache expiry vs preloader schedule (deterministic rule, issue #31): |
| 327 | 390 | // pages that expire faster than the preloader re-warms them leave the |
| 328 | 391 | // cache cold for most real traffic — the classic "24.8% hit ratio with |
| 329 | 392 | // everything on" misconfiguration. Pure logic in |
| @@ -353,8 +416,16 @@ | ||
| 353 | 416 | ? 'Pretty permalinks active.' |
| 354 | 417 | : 'Set permalinks to anything other than "Plain" — page caching needs URL paths to key on.', |
| 355 | 418 | ); |
| 356 | 419 | |
| 420 | + // What is in front of the site, and what we are telling it. Extracted | |
| 421 | + // so it can be exercised without paying for every other probe in | |
| 422 | + // checks(); see edge_check(). | |
| 423 | + $edge_row = self::edge_check(); | |
| 424 | + if ( null !== $edge_row ) { | |
| 425 | + $out[] = $edge_row; | |
| 426 | + } | |
| 427 | + | |
| 357 | 428 | // Cache-poisoning Set-Cookie detection (issue #33): a plugin emitting |
| 358 | 429 | // Set-Cookie on anonymous pageviews forces CDN/edge BYPASS for all |
| 359 | 430 | // HTML (Cloudflare never caches a response carrying Set-Cookie). Probe |
| 360 | 431 | // is transient-throttled inside Cookie_Inspector, same pattern as the |
| @@ -516,8 +587,74 @@ | ||
| 516 | 587 | * wp_get_schedules() lookup. |
| 517 | 588 | * @return array{id:string,tone:string,label:string,detail:string}|null Check |
| 518 | 589 | * row, or null when the rule doesn't apply (preloader off/manual). |
| 519 | 590 | */ |
| 591 | + /** | |
| 592 | + * What cache is in front of the site, and what we are telling it. | |
| 593 | + * | |
| 594 | + * Reported whether or not anything is currently being held back, because | |
| 595 | + * the useful half is the caveat rather than the header. A Cloudflare | |
| 596 | + * Cache Rule set to ignore origin headers overrides everything xSpeed | |
| 597 | + * sends, and someone debugging "my cart page is still being cached" | |
| 598 | + * needs telling that rather than left to discover it. | |
| 599 | + * | |
| 600 | + * Null when nothing was detected and nothing was switched off: there is | |
| 601 | + * no news in "we looked and saw nothing", and a row saying so on every | |
| 602 | + * ordinary single-server site would be noise in a panel people scan for | |
| 603 | + * problems. | |
| 604 | + * | |
| 605 | + * @return array{id:string,tone:string,label:string,detail:string}|null | |
| 606 | + */ | |
| 607 | + public static function edge_check(): ?array { | |
| 608 | + $edge = Edge_Provider::detect(); | |
| 609 | + | |
| 610 | + if ( Edge_Provider::is_off( $edge ) ) { | |
| 611 | + return array( | |
| 612 | + 'id' => 'edge_hold', | |
| 613 | + 'tone' => self::WARN, | |
| 614 | + 'label' => 'Edge cache not being told anything', | |
| 615 | + 'detail' => 'xSpeed is set not to send cache headers to the CDN in front of this site, so first renders and bypassed pages can be stored at the edge. Set "Cache In Front Of This Site" back to automatic unless you are sending your own headers.', | |
| 616 | + ); | |
| 617 | + } | |
| 618 | + | |
| 619 | + if ( Edge_Provider::NONE === $edge['confidence'] ) { | |
| 620 | + return null; | |
| 621 | + } | |
| 622 | + | |
| 623 | + $named = '' !== $edge['provider'] ? $edge['provider'] : 'a cache we could not identify'; | |
| 624 | + | |
| 625 | + // A pin outranks detection by design, so nothing re-checks it on the | |
| 626 | + // site's behalf — and it is the one answer that also reaches the | |
| 627 | + // drop-in and the server rules. Comparing it against the request is | |
| 628 | + // the only way a site that changed CDN ever finds out. | |
| 629 | + $sniffed = Edge_Provider::sniffed(); | |
| 630 | + if ( in_array( $edge['source'], array( 'setting', 'constant', 'filter' ), true ) | |
| 631 | + && '' !== $sniffed['provider'] | |
| 632 | + && $sniffed['provider'] !== $edge['provider'] ) { | |
| 633 | + return array( | |
| 634 | + 'id' => 'edge_hold', | |
| 635 | + 'tone' => self::WARN, | |
| 636 | + 'label' => 'Edge cache setting looks out of date', | |
| 637 | + 'detail' => sprintf( | |
| 638 | + 'This request looks like %s, but the provider is pinned to %s. If the site moved, update it — the pinned answer is also baked into the drop-in and the server rules.', | |
| 639 | + $sniffed['provider'], | |
| 640 | + $named | |
| 641 | + ), | |
| 642 | + ); | |
| 643 | + } | |
| 644 | + | |
| 645 | + $caveat = 'cloudflare' === $edge['provider'] | |
| 646 | + ? ' A Cloudflare Cache Rule whose Edge TTL is "Ignore cache-control header and use this TTL" overrides this; use "Respect origin TTL" on that rule.' | |
| 647 | + : ''; | |
| 648 | + | |
| 649 | + return array( | |
| 650 | + 'id' => 'edge_hold', | |
| 651 | + 'tone' => self::OK, | |
| 652 | + 'label' => 'Edge cache being told what not to store', | |
| 653 | + 'detail' => sprintf( 'First renders, bypassed pages and mobile-split pages are marked do-not-store for %s.%s', $named, $caveat ), | |
| 654 | + ); | |
| 655 | + } | |
| 656 | + | |
| 520 | 657 | public static function expiry_preload_check( int $expiry_hours, string $schedule, bool $preloader_enabled, ?int $interval_hours = null ): ?array { |
| 521 | 658 | if ( ! $preloader_enabled ) { |
| 522 | 659 | return null; |
| 523 | 660 | } |
