What is the difference between max-age and s-maxage?

max-age sets how long any cache may reuse the response, in seconds. s-maxage overrides max-age for shared caches only - CDNs and proxies - while leaving the browser cache governed by max-age. A common pattern is a short max-age for browsers and a longer s-maxage so the CDN absorbs traffic and the browser revalidates more often.

When should I use immutable?

Use immutable for content-hashed static assets - files whose name changes when the content changes, like app.4f3a2b.js. It tells the browser the file will never change for that URL, so it should not even send a revalidation request during the max-age window. Pair it with a long max-age (often a year). Never use immutable on a URL whose content can change.

What does no-store mean versus no-cache?

no-store means do not save this response anywhere - use it for sensitive, personalized data. no-cache is misleadingly named: it allows storing the response but requires revalidation with the server before each reuse. So no-cache still saves a round trip on a 304 Not Modified, while no-store never reuses anything.

Cache-Control header builder

Build a correct Cache-Control header from plain options — with a plain-English explanation of exactly what it tells browsers and CDNs to do. Start from a preset or tune it yourself.

Caching is free speed — if the header is right

Cache-Control is one of the highest-leverage headers you can set: get it right and a CDN serves most of your traffic for free while users get instant loads; get it wrong and you either serve stale data or hammer your origin on every request. The hard part is that the directives interact — no-cache does not mean don’t cache, immutable is unsafe on changing URLs, and shared vs private caches follow different rules. Building it from intent, with the meaning spelled out, keeps those traps visible.

Free tools for the backend you run.

One of a set of free developer tools from Infraveil — the control plane for running, securing, and watching your backend on servers you own. Pairs with the security headers and reverse-proxy tools.

See all free tools

Get the backend toolkit

Practical tools and guides for shipping and running a backend you own. No spam.

Cache-Control builder.

Caching is free speed — if the header is right

Free tools for the backend you run.

Get the backend toolkit