Cache headers explained: Cache-Control, Expires, ETag and how a CDN reads them

Speed, Cache & CDN·· 68 views· 4 min read

The short answer: every file the server sends comes with a few lines the visitor never sees, the headers. Some of them tell whoever receives the file whether it may keep it, for how long, and how to check later whether it changed. Browsers read them, and so does a CDN. Nearly every cache surprise (the old file that will not go away, a personal page handed to someone else, a CDN that caches nothing) starts in one of these headers. We do not sell a CDN: what follows applies to whichever CDN you choose, on an account of your own, opened directly with that provider.

The headers that matter

Header What it tells a cache
Cache-Control: max-age How many seconds the copy counts as fresh. While it is, the browser and the CDN use it without asking the server anything.
s-maxage The same lifetime, but only for shared caches (CDNs and proxies). When present, the CDN uses it instead of max-age. It lets the CDN keep a copy longer than the browser does, or shorter.
public and private public: any cache may store it. private: only the visitor’s own browser; a CDN should not store it. This is what personal pages use.
no-cache It may be stored, but it must be checked with the server before every use. Despite the name, it does not forbid storing.
no-store Do not store it anywhere. For personal or sensitive content.
Expires The old way of giving a lifetime, as a fixed date and time. If max-age is present, max-age wins.
ETag and Last-Modified A fingerprint and the date of the version. They answer the question “has it changed?”: whoever holds the copy sends If-None-Match or If-Modified-Since, and if nothing changed the server answers 304 Not Modified without sending the file again.
Vary Says the response depends on another request header (for example Accept-Encoding). The CDN keeps one copy per variant. A Vary: Cookie or Vary: User-Agent can leave the CDN with almost no hits.
Age Added by the cache: how many seconds that copy has been stored. If you see it, the response came from a cache and not from the server.

Seeing and fixing your site’s headers

1 In the browser: F12, Network tab, reload the page, click a file and read the Response Headers.
2 From the command line: curl -sI https://www.yourcompany.com/ shows only the page’s headers. Repeat with the address of an image or a stylesheet and compare.
3 Compare with the healthy pattern: static files with a version in the name get a long lifetime; HTML pages get a short one or no-cache; pages with a session get private and no-store. For example:
# CSS, JS and images with a version in the name
Cache-Control: public, max-age=<long lifetime>, immutable
# public HTML pages
Cache-Control: public, no-cache
# cart, account, checkout
Cache-Control: private, no-store
4 To change what the server sends: through .htaccess (see browser caching with .htaccess) or through the cache plugin on WordPress (LiteSpeed Cache: the first settings).
5 See what the CDN does with them: many CDNs let you set one lifetime for their own copy and another for the browser, on top of what the server sends. Check in the provider’s dashboard which one wins.
6 After changing them, purge the CDN, or it keeps serving copies stored under the old rules: purging a CDN cache.
Do not force the CDN to cache everything regardless of headers. A response carrying Set-Cookie or private is personal. If a “cache everything” rule overrides that, the CDN hands the response to whoever comes next: swapped sessions, someone else’s cart. See what must never be cached.
Two clocks, two lifetimes. You can purge the CDN’s cache whenever you like; you cannot purge your visitors’ browsers. So it pays to give the CDN the longer lifetime (s-maxage) and the browser a shorter one (max-age), except for files with a version in the name.

Your site’s headers do not say what you expected? Send us the file address and what curl -sI shows.

Open a support ticket

SEE ALSO

Browser caching with .htaccess

Visitors still see the old CSS or logo: versioned file names and cache busting

Origin and edge in a CDN: HIT, MISS, BYPASS and what an origin shield does

Purging a CDN cache: one file, a folder or everything, and when not to purge

What a CDN does for you: caching, compression, images and protection

Security headers explained: what they do and how to add them in .htaccess

RECOMMENDED PRODUCT

Web hosting with cPanel

Domain and SSL included, daily backups and the panel you already know. from $6.60/mo (3-year plan, with coupon)

See plans
Was this answer helpful? Your answer helps us improve this article.