---
title: "Cache-Control"
description: "Cache-Control is the HTTP header that tells browsers and CDNs whether and how long to cache a response. Learn max-age, no-store, immutable and more."
url: "https://nodea.io/en/glossary/cache-control"
lang: "en"
updated: "2026-07-13"
---

# Cache-Control

> Cache-Control is an HTTP response header that tells browsers, proxies and CDNs whether a response may be cached, for how long, and how its freshness should be revalidated.

**Cache-Control** is an [HTTP](https://nodea.io/en/glossary/http) header a server attaches to its responses to declare the caching rules for that resource: whether it can be stored at all, by whom (the user's browser only, or shared caches such as a [CDN](https://nodea.io/en/glossary/cdn)), for how long it stays fresh, and what must happen once it expires. Getting these rules right is one of the highest-leverage performance optimisations on the web — a well-cached asset costs the origin server nothing.

## How Cache-Control works

The header carries a comma-separated list of directives, for example *Cache-Control: public, max-age=31536000, immutable*. The key directives are:

- **max-age** — freshness lifetime in seconds (effectively the [TTL](https://nodea.io/en/glossary/ttl)); until it elapses, the cached copy is served without contacting the origin;
- **s-maxage** — a separate lifetime for shared caches, overriding max-age at the CDN or proxy layer;
- **public / private** — whether shared caches may store the response or only the end user's browser;
- **no-cache** — storing is allowed, but every reuse requires revalidation with the origin via ETag or Last-Modified;
- **no-store** — nothing may be written to any cache; used for sensitive content such as account pages;
- **immutable** — a promise that the resource will never change within its lifetime, so browsers skip revalidation on reload;
- **stale-while-revalidate** — serve the expired copy instantly while fetching a fresh one in the background.

## Practical use cases

The canonical strategy is split by asset type. Fingerprinted static files (styles.a1b2c3.css, bundle.9f8e7d.js) get a one-year max-age with immutable, because any content change produces a new URL. HTML documents and API responses get short lifetimes or no-cache with validators, so deployments become visible immediately. Sensitive responses — logins, carts, dashboards — get no-store.

Headers are configured in the web server (Nginx add\_header, Apache mod\_headers or .htaccess) or set by the application framework. Verification takes seconds: open the browser DevTools Network tab and inspect the response headers, or run curl -I against the URL to confirm the policy actually reaching clients.

### Does Cache-Control apply to CDNs as well as browsers?

Yes. Directives such as public, private and s-maxage exist specifically to control shared caches. s-maxage overrides max-age for CDNs and reverse proxies, letting you keep a long edge cache while browsers revalidate more often — or the other way round.

## Related

- [Cache and microcaching](https://nodea.io/en/glossary/cache-and-microcaching)
- [CDN (Content Delivery Network)](https://nodea.io/en/glossary/cdn)
- [TTL](https://nodea.io/en/glossary/ttl)
- [HTTP](https://nodea.io/en/glossary/http)
- [TTFB](https://nodea.io/en/glossary/ttfb)

---

Languages: [pl](https://nodea.pl/pl/slownik-pojec/cache-control.md)  
Site index: [llms.txt](https://nodea.io/en/llms.txt)