Cache-Control decides what browsers and CDNs keep, for how long and for whom. Right, and most traffic never reaches your server. Wrong, and you either pay for every request or show one user's page to another. The directives that matter, four recipes, and what CloudFront charges when the cache misses.
There are two kinds of cache between users and your server. A private cache is the user's browser and holds only their responses. A shared cache, such as a CDN, keeps one copy and serves it to everyone who asks for the same thing. The Cache-Control header (RFC 9111) instructs both.
Book a free 30-minute call. You'll leave knowing what we'd do first and roughly what it costs, whether or not you hire us.
A CDN treats two requests as the same when their cache keys match: the URL, plus whichever headers, cookies and query strings you include. Include too little and users get each other's variants. Include too much, such as every cookie and tracking parameter, and almost every request is unique, so you pay for a CDN that caches nothing.
A personalized response in a shared cache is shown to the next visitor. It usually happens when a CDN rule or framework caches a path that sometimes returns signed-in content. Mark anything user-specific private or no-store explicitly, and do not let a CDN cache responses that set cookies.
On CloudFront pay-as-you-go, the first 1 TB of transfer and 10 million requests each month are free; then US transfer starts at $0.085 per GB and HTTPS requests at $0.0100 per 10,000. Flat-rate plans start at free and $15 a month with fixed allowances. Either way, the larger saving from a better hit rate is usually the load that never reaches your servers.
Once a month: what changed in tech that month and what it means for you, from cloud and AI to security and the tools you build with. Every item links to its source. No sales pitch, unsubscribe in one click.
Book a free 30-minute call about it. Bring your setup and your bill; you'll leave knowing what we'd do first and roughly what it costs, whether or not you hire us.
Or keep reading
Your App Has Users Now: The Internet Underneath It, on One Page
Building fast skips the parts of the internet that only matter once people depend on you: DNS, certificates, email authentication, caching, timeouts, backups and abuse. What happens between someone typing your domain and your database answering, what breaks at each step, and the order we would fix things in.
Read
Why Are Applications Slower for Users in Some Regions? Round Trips and the Speed of Light
Most slow apps are not slow because of code. They are slow because of distance multiplied by round trips: a database in a different region from the server, twenty sequential queries per page, a new connection per request. The arithmetic, and the fixes in order of payoff.
Read
As of October 26, 2026. Provided as is, for general information, and accurate to the best of our knowledge on the date shown. Not legal, compliance, tax, financial or other professional advice. Prices, limits and vendor services change; check current vendor documentation before relying on anything here. Terms of use.