On this page
The core idea
The Cache-Control header tells browsers and shared caches such as CDNs how they may store a response. max-age sets how long a response stays fresh for a browser, s-maxage sets it for shared caches, private forbids shared caches from storing it and no-store forbids storage entirely. Validators such as ETag let a client ask whether a stale copy is still current and receive a small 304 Not Modified response instead of the full body. Without explicit headers, intermediaries apply heuristics you did not choose.
A practical approach
Step 1
Classify each response: versioned static assets, public pages that change occasionally, personalised content and sensitive data.
Step 2
Serve fingerprinted static assets, whose filename changes with content, with a long max-age and the immutable directive.
Step 3
Give public pages a short shared-cache lifetime with s-maxage and, where supported, stale-while-revalidate so users get fast responses while the cache refreshes.
Step 4
Mark personalised responses private, and sensitive responses such as account or payment data no-store.
Step 5
Add ETag or Last-Modified validators to responses that are revalidated, and verify behaviour by inspecting headers in the browser's network panel.
Worked example
A CDN in front of a learning platform caches the /api/me endpoint because it has no Cache-Control header and the CDN is configured to cache aggressively. For a few minutes, some learners see another learner's name in the header. Adding Cache-Control: private, no-store to all personalised API responses stops shared caching, and the CDN configuration is updated to respect origin headers.
A mistake to avoid
Do not use no-cache when you mean no-store. no-cache allows storing a response but requires revalidation before each use; only no-store prevents the response from being stored.
Try it yourself
Open your site's network panel and list the Cache-Control header for five different responses: a script, an image, a public page, an API call and an account page. Decide whether each is right and fix one that is not.
Your implementation checklist
- Every response type has a deliberate caching rule
- Fingerprinted assets are cached long and immutable
- Personalised responses are private
- Sensitive responses use no-store
- Validators allow cheap revalidation
Share or cite this guide
Innovate with Ajay Editorial (2026-10-07). Use HTTP Cache Headers Deliberately. https://innovatewithajay.com/blogs/use-http-cache-headers-deliberately