Header Prism

HTTP header & security policy tools

07Cache-Control · RFC 9111Generator & explainer

Cache-Control generator

Choose who may store a response and for how long, from browser to CDN. Or paste a header you already send and read what each directive does.

A

Build

For files whose name changes when the content changes (app.3f9a1c.js). Cache for a year, never revalidate.

Who may store it
B

Header

Cache-Control: public, max-age=31536000, immutable
Browser stores
Yes
Browser reuses for
1 year
CDN stores
Yes
CDN serves for
1 year
Stale while refreshing
—
Stale on errors
—
    C

    Server configuration

    /assets/*
    
				
    
			
    
		
    

		
    
			
    D
    Explain an existing header
    
			
    
				
				
				
    
					
    
				
    
				
    
			
    
		
    
	
    

	
    
		
    
			
    Picking the right policy
    
			
    Most sites need only three rules. Files with a content hash in their name get public, max-age=31536000, immutable: a new deploy produces new URLs, so old copies never need checking. HTML gets no-cache: browsers keep a copy but ask the server each time, which costs a small 304 when nothing changed. Anything personal gets private, or no-store if it should not stay on disk.
    
			
      
				
    • no-cache is not “don't cache”. It means “revalidate before use”. Use no-store to prevent storage.
      • 
				
    • s-maxage lets a CDN keep a page longer than browsers; stale-while-revalidate hides the refresh from visitors.
      • 
				
    • Cookies and shared caches do not mix: a response that sets a cookie should not be public with a lifetime.
      • 
			
    
			
		
    
	
    

	
    
		
    FAQ
    Cache-Control questions
    
		
    
			
    
				Do I still need Expires or Pragma?
				
    No. max-age overrides Expires in every current client, and Pragma: no-cache is a request header from HTTP/1.0. They only matter for very old proxies.
    
			
    
			
    
				Why does my CDN ignore max-age?
				
    Many CDNs apply their own rules, skip HTML by default, or never cache responses that set cookies. Check your CDN's cache settings, or send s-maxage or CDN-Cache-Control for the edge.
    
			
    
			
    
				How do I make browsers fetch a new version?
				
    Change the URL, usually with a content hash in the file name. A cached response that is still fresh is not requested again, so a long max-age on a stable URL cannot be recalled.