Caching headers: Cache-Control and ETag

Caching is the reason a second visit to a site is fast. Three headers do most of the work.

Cache-Control

Cache-Control tells browsers and shared caches (a CDN, a proxy) what they may keep. Settings that matter most:

The names are confusing: no-cache does not mean "do not cache".

A file that never changes

Files with a version or hash in their name can be cached for a year. This is the response of our test server for a stylesheet:

GET /cache HTTP/1.1
Host: example.com

HTTP/1.1 200 OK
Date: Sat, 14 Nov 2026 10:00:00 GMT
Content-Type: text/css
Cache-Control: public, max-age=31536000, immutable
Content-Length: 6

body{}

A private page

GET /nocache HTTP/1.1
Host: example.com

HTTP/1.1 200 OK
Date: Sat, 14 Nov 2026 10:00:00 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: no-store
Content-Length: 14

<p>private</p>

no-store is right for pages with private data, such as a bank balance. It means no reuse at all, so every visit downloads the page again.

Validation with ETag

An ETag is a label for one version of a file. The browser sends it back and the server can answer with a short 304 if nothing changed. First request:

GET /etag HTTP/1.1
Host: example.com

HTTP/1.1 200 OK
Date: Sat, 14 Nov 2026 10:00:00 GMT
ETag: "v7"
Cache-Control: max-age=60
Content-Type: text/plain; charset=utf-8
Content-Length: 13

version seven

Second request, after the cached copy expired:

GET /etag HTTP/1.1
Host: example.com
If-None-Match: "v7"

HTTP/1.1 304 Not Modified
Date: Sat, 14 Nov 2026 10:00:00 GMT
ETag: "v7"
Cache-Control: max-age=60

The 304 response has no body. The browser reuses its stored copy and updates its freshness. Read more on the 304 page.

A simple plan

1. HTML pages: no-cache with an ETag, or a short max-age.
2. Files with hashed names (CSS, JS, images): max-age=31536000, immutable.
3. Private pages: no-store.

This is an independent guide. It is not connected with the IETF, IANA, any browser maker or any company named here. Meanings were checked against the RFC texts on 14 November 2026. Responses shown were recorded on 14 November 2026 from a small test server on the author's own computer.