Overview

Cache-Control carries a list of directives that dictate caching behavior on both requests and responses. On a response it tells browsers, CDNs, and proxies how long and how to store and reuse the response. It is the de facto standard for HTTP caching policy.

Details

The core concept is freshness. `max-age=3600` marks a response fresh for 3600 seconds, reusable without hitting the network. Once it goes stale, the cache revalidates with the server using `ETag`/`If-None-Match` or `Last-Modified`/`If-Modified-Since`; a 304 Not Modified refreshes the cache without resending the body.

Storage scope splits into `public` (shared caches allowed), `private` (private caches only), and `no-store` (must not store). Despite its name, `no-cache` does not mean 'don't store' but 'must revalidate before reuse' — a frequent confusion. `s-maxage` is a max-age applied only to shared caches (like a CDN), and `immutable` lets versioned static assets skip revalidation entirely for performance.

Cache-Control (relative time) takes precedence over the legacy `Expires` (absolute time) header and is more precise. When a response varies by request headers (Accept-Encoding, language, ...), pair it with `Vary` so caches don't serve the wrong representation.

Syntax

Cache-Control: <directive>[, <directive>]*

e.g. Cache-Control: public, max-age=3600, stale-while-revalidate=60

Directives / values

Notes

• no-cache and no-store are entirely different — no-cache stores then revalidates, no-store forbids storing at all.
• For responses with sensitive personal data, specify `no-store` (and `private` if needed).
• The standard pattern for static assets is a hashed filename plus `max-age=31536000, immutable` for long-term caching.
• `max-age=0, must-revalidate` is a common combo that forces revalidation every time.
• Service Worker caches operate independently of this header, so consider both together.

Related headers

Related status codes

Specification