Cache-Control

Cache-Control is an HTTP header a server attaches to its responses to declare the caching rules for that resource: whether it can be stored at all, by whom (the user's browser only, or shared caches such as a CDN), for how long it stays fresh, and what must happen once it expires. Getting these rules right is one of the highest-leverage performance optimisations on the web — a well-cached asset costs the origin server nothing.

How Cache-Control works

The header carries a comma-separated list of directives, for example Cache-Control: public, max-age=31536000, immutable. The key directives are:

• max-age — freshness lifetime in seconds (effectively the TTL); until it elapses, the cached copy is served without contacting the origin;
• s-maxage — a separate lifetime for shared caches, overriding max-age at the CDN or proxy layer;
• public / private — whether shared caches may store the response or only the end user's browser;
• no-cache — storing is allowed, but every reuse requires revalidation with the origin via ETag or Last-Modified;
• no-store — nothing may be written to any cache; used for sensitive content such as account pages;
• immutable — a promise that the resource will never change within its lifetime, so browsers skip revalidation on reload;
• stale-while-revalidate — serve the expired copy instantly while fetching a fresh one in the background.

Practical use cases

The canonical strategy is split by asset type. Fingerprinted static files (styles.a1b2c3.css, bundle.9f8e7d.js) get a one-year max-age with immutable, because any content change produces a new URL. HTML documents and API responses get short lifetimes or no-cache with validators, so deployments become visible immediately. Sensitive responses — logins, carts, dashboards — get no-store.

Headers are configured in the web server (Nginx add_header, Apache mod_headers or .htaccess) or set by the application framework. Verification takes seconds: open the browser DevTools Network tab and inspect the response headers, or run curl -I against the URL to confirm the policy actually reaching clients.