The REST response we cached at the edge

A public REST endpoint serving the same payload to everybody, hit forty thousand times a day, and generated forty thousand times.

add_filter( 'rest_post_dispatch', function ( $response, $server, $request ) {
    if ( $request->get_route() !== '/turkerdev/v1/products' ) {
        return $response;
    }

    if ( is_user_logged_in() ) {
        return $response;   // never cache a personalised response
    }

    $response->header( 'Cache-Control', 'public, max-age=60, s-maxage=300' );

    return $response;
}, 10, 3 );

WordPress sends no-cache on REST responses by default, which is the safe choice and means a public endpoint gets no edge caching without an explicit opt-in. The logged-in guard is the part that must come first: a personalised response cached at an edge is a data leak, and the cookie check has to happen before the header is set rather than being trusted to a downstream rule.