To test, place this file in your Kinsta site's web root and request it without the logged-in cookie being set. Kinsta will happily cache this response at Cloudflare's edge locations, despite the Cache-Control headers explicitly telling it not to.

test-nocache-headers.php

<?php

header("Expires: Wed, 11 Jan 1984 05:00:00 GMT");
header("Cache-Control: no-cache, must-revalidate, max-age=0, no-store, private"); // nocache_headers() in WordPress 
echo time();