Cache-Control: no-cache vs no-store vs max-age=0 (and which one you want)
The names are misleading. <code>no-cache</code> sounds like it turns caching off, but it does not. Here is what each directive really does, and a few header recipes you can copy.
The directives that matter
| Directive | What it really means |
|---|---|
max-age=N | Reuse the saved copy without asking for N seconds. |
s-maxage=N | Same, but only for shared caches (CDNs, proxies); overrides max-age there. |
no-cache | May store, but revalidate with the server before every reuse. |
no-store | Never write it to any cache, browser or shared. |
private | Only the user’s own browser may store it, not a CDN. |
public | Shared caches may store it, even for requests with an Authorization header. |
must-revalidate | Once stale, never serve it without checking first (no “stale but better than nothing”). |
immutable | The file at this URL will never change, so do not revalidate even on reload. |
stale-while-revalidate=N | For N seconds after expiry, serve the old copy instantly and refresh it in the background. |
Recipes
# HTML pages: always fresh, but cheap 304s
Cache-Control: no-cache
# Hashed assets (app.3f9a1c.css): keep for a year
Cache-Control: public, max-age=31536000, immutable
# Public API JSON that may lag by a minute
Cache-Control: public, max-age=60, stale-while-revalidate=300
# Account pages, tokens, anything personal
Cache-Control: no-store
Common mistakes
- Using
no-cachefor secrets. The response may still be written to disk. Useno-store. - Long max-age on un-hashed files.
style.csswithmax-age=86400means visitors see the old file for up to a day after a deploy. Hash the filename: see old CSS after a deploy. - Forgetting
privateon personalised pages behind a CDN, which can then serve one user’s page to another. - Relying on
Pragma: no-cacheorExpires. They are HTTP/1.0 leftovers;Cache-Controlwins when both exist. - Setting
no-storeon everything “to be safe”. It disables the back/forward cache in many browsers and makes every visit slower.
Check what a site sends
curl -sI https://example.com/ | grep -i cache-control
curl -sI https://example.com/assets/app.css | grep -iE 'cache-control|etag|age'
Anvil’s URL inspection endpoint shows a page’s response headers as JSON. To see how fresh copies, hard refresh and 304 replies play out, try the Wirebook browser-cache lesson.
Related
Share links you can revoke · Can you revoke an S3 presigned URL? · HTTP 304 Not Modified · Old CSS after a deploy · localStorage vs cookies · Set-Cookie explainer · CSP header builder
Questions
Does Cache-Control no-cache mean do not cache?
No. It means a cache may keep a copy but must check with the server before reusing it. To prevent storing entirely, use no-store.
What is the difference between no-cache and max-age=0?
Both make the copy need checking before reuse. no-cache states it directly; max-age=0 makes the copy stale immediately, and some caches may still serve stale content unless must-revalidate is added.
When should I use no-store?
For responses containing personal or sensitive data, such as account pages, tokens and banking details, which should never be written to any cache.
What does immutable do?
It tells the browser the file at that URL will never change, so it skips revalidation even when the user reloads. Use it only on content-hashed filenames.
What Cache-Control should HTML pages use?
Usually no-cache, so browsers always check for a new version but can get a cheap 304 when nothing changed.
Published · updated .