Cache customized pages only when the cache boundary matches the audience for the content. For a page containing one user’s identity, permissions, cart, or account data, use Cache-Control: private so shared caches do not reuse it; use no-store when no cache should retain it. For content safe to share, include every output-changing dimension in the cache key. A common performance-friendly design is to cache an anonymous page shell and load personal data separately.
Choose the cache boundary before choosing the headers
Start by asking who may safely receive the exact same representation. A response is not safe for a shared cache merely because most of its HTML is common: if it includes a name, account status, permissions, cart contents, or another user-specific value, the complete response is personalized.
- One user only: keep the response in a private browser cache with
private, or prevent storage entirely withno-store. - A defined group can share it: use shared caching only if every input that changes the representation is represented in the cache key.
- Common content plus personal details: cache the common shell and fetch account-specific data through a separate private request.
A cookie alone does not make a response private. Cache directives and the CDN’s actual cache-key and rule behavior determine whether a response can be stored or reused.
What the main cache directives mean
| Directive | What it permits | Use it when |
|---|---|---|
private |
A private browser cache may store the response; shared caches must not. | The response is personalized but browser storage is acceptable. |
no-store |
Caches must not store the response. | Policy requires that neither browser nor intermediary retain the content. |
no-cache |
A cache may store the response but must validate it before reuse. | Storage is useful, but reuse must be checked for freshness. |
no-cache does not mean “do not store.” For sensitive responses that must not be retained, choose no-store. For personalized HTML that may be held in a browser’s private cache and revalidated before reuse, combine private with no-cache.
#1 Best Overall
- Used Book in Good Condition
Pattern 1: Keep a fully personalized page private
For dashboards, account pages, and carts whose HTML contains user-specific data, a practical starting point is:
Cache-Control: private, no-cache
ETag: "account-<representation-version>"
Last-Modified: <representation-date>Replace the validator examples with values generated for the actual representation. The browser may store the page privately, but must check with the server before reusing it. If the response must not be stored at all, use Cache-Control: no-store instead of the private, revalidated policy.
Rank #2
Pattern 2: Cache shared variants with complete keys
A page can be shared across users when the audience and variants are safe and bounded—for example, language or supported content format. The response can declare request-header dimensions with Vary:
Vary: Accept-Language, Accept
Cache-Control: public, max-age=300, s-maxage=600The cache key must use the normalized values of every dimension that changes the output. The sample freshness values are illustrative configuration values, not universal recommendations: set them to match the content’s update and purge requirements. Vary communicates header-based variation; verify that the browser, CDN, and any intermediary in use actually honor the dimensions. If the provider needs an equivalent custom cache-key rule, configure it there rather than assuming an unsupported header will protect variants.
The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Rank #3
Avoid putting raw session identifiers or other secrets in cache keys. High-cardinality values fragment the cache, while secret or user-specific values can create privacy risks. Cloudflare documents Vary: Accept-Language as a cache-key input when configured, and says Vary: * always bypasses cache: Cloudflare Vary documentation.
Pattern 3: Cache the shell, fetch private data separately
When a page is mostly common but includes a few personalized elements, split them rather than making the entire HTML response private or trying to share a user-specific page. Put anonymous navigation, product copy, and other broadly shareable content in a cacheable shell. After it loads, request the account name, entitlements, recommendations, or cart state through a private endpoint or another path that cannot be served from a shared cache.
Rank #4
This design makes the privacy boundary visible in the architecture: the shell is intentionally shareable; the personal response is not. Keep the private request’s cache policy explicit, and ensure it cannot be folded into the shared shell by server-side rendering or an edge rule.
Pattern 4: Revalidate stored, non-sensitive HTML
For HTML that is safe to store but should be current when reused, send Cache-Control: no-cache with an ETag, a Last-Modified date, or both. The cache can retain the representation and make a conditional request before reuse. If the representation has not changed, the server can confirm that without retransmitting the full body; if it has changed, the cache receives the updated response.
Recommended Free Tools
Validators address freshness, not audience. They do not make personalized content safe for a shared cache. Apply the appropriate privacy directive independently.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Check CDN behavior before enabling HTML caching
CDN defaults and origin headers may differ from custom edge rules. Cloudflare says dynamic HTML is not cached by default, though Cache Rules can enable caching, including for anonymous page views. Its documented default behavior prevents caching responses carrying private, no-store, no-cache, max-age=0, or Set-Cookie; a positive public, max-age permits caching. An edge TTL configured through Cache Rules can override origin cache headers, so treat such an override as a privacy-sensitive production change. See Cloudflare’s default cache behavior and Cloudflare’s Cache Rules guidance.
For CDN-specific freshness directives, RFC 9213 defines CDN-Cache-Control, which can separate edge freshness from browser freshness when the deployment and provider support it: RFC 9213.
Test the privacy boundary and each variant
Configuration is not verified until requests behave correctly in realistic cache states. Use two distinct test accounts and inspect both browser and CDN responses.
Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Clear out junk files and repair common Windows errorsFree Scan →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Quick Recap
- Request the page as user A, then request the same URL as user B while the cache may contain user A’s response. Confirm user B never receives user A’s identity, permissions, cart, or other account data.
- Test logged-in and anonymous requests, including requests with
Set-Cookie,Authorization, and session cookies. Confirm they cannot produce an unsafe shared-cache hit. - Request each supported language, format, or experiment variant in different orders. Confirm each request receives the matching representation and that the normalized key separates variants correctly.
- Change content or permissions, then check the configured purge and bypass paths. Confirm old or newly unauthorized data cannot be served from a stored response.
- Inspect
Age, provider cache-status indicators,ETag, andVaryin responses. Verify they match the intended policy in both the browser and CDN path.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
