Compose an HTTP caching policy from clear options, parse an existing header, and catch contradictory directives before deployment.
The HTTP Cache-Control response header tells browsers and shared caches how a response may be stored and reused. A correct policy can reduce latency and origin traffic. A wrong policy can expose private data, serve outdated content, or force unnecessary downloads.
This builder produces a header plus configuration snippets for common deployment environments. The parser accepts a header with or without the Cache-Control: prefix and explains the recognized directives.
Cache-Control: public, max-age=31536000, immutable
Use a long lifetime only when the asset URL changes whenever its content changes, such as a JavaScript bundle containing a content hash.
Cache-Control: no-cache
Despite its name, no-cache allows storage but requires revalidation before the stored response is reused. Use no-store when a response must not be stored at all.
Cache-Control: public, max-age=300, s-maxage=300, stale-while-revalidate=86400
This keeps the response fresh for five minutes and allows a shared cache to serve stale content while refreshing it in the background for up to one day.
public permits shared caches to store a response when other rules allow it.private limits storage to private caches such as a user's browser.max-age sets freshness lifetime in seconds.s-maxage overrides freshness lifetime for shared caches.no-cache requires revalidation before reuse.no-store prohibits storage.immutable tells clients that a fresh response will not change.must-revalidate requires validation after a response becomes stale.Generating a header does not prove that an application or CDN is sending it. After deployment, inspect the actual response in browser developer tools or with a command such as curl -I. Check redirects and error responses separately because they may follow different rules.
Never apply a public caching preset to personalized pages, authentication responses, checkout data, or other user-specific content without a complete cache-security review.
Modern HTTP caching behavior is defined by RFC 9111. Use the Hash Generator for content digests or the SRI Hash Generator when a browser must verify an external script or stylesheet.
Keep working