Caching · Request & Response

Cache-Control

Directives that control caching behavior.

What is Cache-Control?

Cache-Control is the primary way to instruct browsers and CDN caches how, and how long, a response can be reused. It supersedes older headers like Expires and Pragma.

Typical usage

Set on almost every response. Static assets get long max-age + immutable; HTML gets short max-age or no-store; sensitive responses get no-store.

Examples

Static asset, cache forever

Cache-Control: public, max-age=31536000, immutable

HTML, revalidate every time

Cache-Control: no-cache

Private data, never store

Cache-Control: no-store

CDN caches 1 hour, browsers 1 min

Cache-Control: public, s-maxage=3600, max-age=60

Common gotchas

no-cache does NOT mean 'don't cache' — it means 'cache, but revalidate every time'. Use no-store if you want zero caching. Confusing these two is one of the top HTTP mistakes.

Specification

RFC 9111

Related headers

ETag

A version identifier for the resource — the backbone of conditional GETs.

Expires

Legacy: an absolute HTTP date when the response becomes stale.

Vary

Which request headers cause different cached variants of the response.

Age

How many seconds the response has been in a shared cache.