Caching headers (Cache-Control / max-age)
Response headers that tell browsers and CDNs how long they may reuse a file instead of asking your server for it again.
See it
What it is
Caching headers are the response headers that tell every cache between your server and the user how long a file may be reused without asking again. The main one is 'Cache-Control': 'max-age' in seconds for the browser, 's-maxage' for shared caches like a CDN, 'public' or 'private' for who may store it, and 'immutable' for 'do not bother revalidating while this response is still fresh'. Read 'immutable' carefully: it does not freeze the URL forever. The response still expires when its freshness lifetime runs out; immutable only stops the browser sending revalidation requests before then. 'ETag' and 'Last-Modified' let a stale copy be revalidated with a cheap 304 instead of a full re-download.
The standard split: fingerprinted build assets (app.a91f3c.js) get 'Cache-Control: public, max-age=31536000, immutable' because a new build produces a new URL. HTML documents get 'no-cache' or a very short max-age, because that document is what points at the new filenames. Get this pair right and repeat visits cost almost nothing.
The gotcha everyone hits: 'no-cache' does not mean do not cache. It means store it but revalidate before every use; the header you want for genuinely secret responses is 'no-store'. The other trap is a long max-age on a file whose name never changes. Once that is in someone's browser you cannot recall it, and 'tell users to hard refresh' is not a deploy strategy.
Ask AI for it
Configure caching headers for this app. Serve fingerprinted static assets under /assets/* with 'Cache-Control: public, max-age=31536000, immutable'. Serve HTML documents with 'Cache-Control: no-cache' so the browser revalidates and always picks up new asset URLs after a deploy. Serve API responses with 'private, no-store' unless the data is public, in which case use a short max-age plus stale-while-revalidate. Keep ETags on so revalidation returns 304 instead of the full body. Show me the exact config for this server or host.