@Krinkle wrote at T432488#12134352:

5% ~20ms : ConfirmEdit (HCaptcha) extension Hooks::onMakeGlobalVariablesScript is calling User::getBlock (via addIPBlocksScoreCollectionVars) on every pageview. This is a regression introduced last month in T426943. It adds 5% to all latencies through multiple network roundtrips (new connection to GlobalBlocking DB, DB queries, memcached queries). At glance, this doesn't actually work because logged-out pageviews are CDN-cached so this is either an expensive no-op or actively poisoning caches. I've confirmed just now that when perfoming a logged-out pageview from a VPN connection (one that we block from editing) my cache miss poisoins the CDN cache with HCaptchaBlockedIpEditingScoreCollectionSiteKey.

Steps to reproduce:

• Request https://en.wikipedia.org/wiki/Banana in private browsing, and view source to confirm wgHCaptchaBlockedIpEditingScoreCollectionSiteKey is not there for you (assuming your home IP is not blocked).
• Enable a VPN of which the IP range is globally blocked on Meta-Wiki, e.g. Proton VPN.
• Request https://en.wikipedia.org/wiki/Banana?_cachebust=foobar in private browsing, and view source to confirm wgHCaptchaBlockedIpEditingScoreCollectionSiteKey is now there. Also note that the X-Cache-Status header shows a cache miss, not a cache pass.
• Hard refresh, and confirm this is a CDN cache hit.

/cc @Dreamy_Jazz @kostajh per https://gerrit.wikimedia.org/r/c/mediawiki/extensions/ConfirmEdit/+/1295484