Cache-Control
Specifies browser and CDN caching directives for requests and responses, dramatically accelerating load speeds or preventing cache leakage.
public, max-age=31536000, immutable (Static Assets) OR no-store, max-age=0 (Dynamic APIs)Production Server Implementation
expires 1y; add_header Cache-Control "public, immutable";Directives & Syntax Breakdown
Forbids browsers and CDNs from storing any response data on disk or memory (essential for private user data).
Maximum lifetime in seconds that a cached resource is considered fresh.
Indicates the response body will never change over time, bypassing conditional validation requests.
Allows serving stale cached data instantly while fetching an updated copy in the background.
Common Security Hazards & Pitfalls
- •Do NOT use "immutable" on assets without cache-busting hashes (like main.css instead of main.a1b2c3.css).
- •Using "no-cache" does NOT mean do not cache; it means revalidate with the server before using.
Cache-Control - Questions & Answers
Common implementation questions, browser enforcement rules, and debugging.
"public, max-age=31536000, immutable" provides maximum performance because modern bundlers give changed files unique hashes.
Related HTTP Headers
Browse All HeadersRestricts where scripts, images, styles, and frames can be loaded from, protecting websites from Cross-Site Scripting (XSS) and data injection attacks.
Forces modern web browsers to communicate exclusively over encrypted HTTPS connections, preventing SSL stripping and man-in-the-middle (MITM) attacks.
Indicates whether a browser should be allowed to render a page inside an <iframe>, <frame>, or <object>, protecting users against clickjacking attacks.
Prevents the browser from MIME-sniffing a response away from the declared Content-Type header, mitigating drive-by malware and MIME confusion attacks.
Controls how much referrer information (URL path and query parameters) is included when navigating away or loading external assets.
Allows site owners to selectively restrict browser hardware features, sensors, APIs, and privacy-invasive tracking mechanisms.