Cache-Control
BothActiveCache-Control directives control caching behavior in both requests and responses. It determines whether a response can be cached, for how long, and by whom – browser caches, CDNs, or proxy servers. The most important directives are max-age, no-cache, no-store, and public/private.
Cache-Control: <directive>[, <directive>]*
Description
The Cache-Control header holds directives (instructions) in both requests and responses – directives in requests are not necessarily the same as those in responses.
Directives
| Directive | Description |
|---|---|
| max-age=<seconds> | Response is fresh for this many seconds from when it was generated. |
| s-maxage=<seconds> | Like max-age but applies only to shared caches (CDNs). |
| no-cache | Must revalidate with origin before using cached copy. |
| no-store | Do not cache at all. For sensitive data (banking, health). |
| public | Response may be stored by any cache, including CDNs. |
| private | Response is for a single user – only browser cache, not CDNs. |
| immutable | Response will not change during its freshness lifetime. Skip revalidation. |
| stale-while-revalidate=<seconds> | Serve stale while fetching fresh in background. |
Examples
Static asset (1 year)
http
Cache-Control: public, max-age=31536000, immutableNo cache (sensitive)
http
Cache-Control: no-store, no-cache, must-revalidateCDN-friendly API
http
Cache-Control: public, s-maxage=60, stale-while-revalidate=600