What is the Cache-Control header?

Cache-Control is the HTTP header that carries caching directives in requests and responses. On a response, it tells every cache on the path, from the browser to a CDN, whether the response may be stored, how long it stays fresh, and what to do once it is stale. RFC 9111 defines it.

Cache-Control: public, max-age=60, s-maxage=3600, stale-while-revalidate=30

Directives are comma-separated and case-insensitive. The ones that matter most for a CDN are:

• `max-age` and `s-maxage`: how many seconds the response stays fresh, for all caches and for shared caches.
• `no-cache` and `no-store`: revalidate before every reuse, or never store at all.
• `public` and `private`: whether shared caches such as a CDN may store the response.
• `stale-while-revalidate` and `stale-if-error`: when a stale copy may still be served.
• `must-revalidate` and `immutable`: how strictly a cache treats a stale or unchanged response.

A CDN can also read a targeted field such as `CDN-Cache-Control`, which overrides Cache-Control for that CDN only. Many CDNs also apply their own defaults on top of the header: Cloudflare, for example, does not cache HTML by default. Check what your CDN actually does with the cache status it returns, not only with the header you send.