In short. Cache-Control response directives govern whether caches may store a response and when they may reuse it or must validate it.

Definition: Cache-Control is an HTTP header field that carries rules for caches, which store responses for reuse. In a response, its directives control storage, freshness limits, and validation with the original server before reuse.

Key facts

RFC 9111, HTTP Caching, published in June 2022, defines response directives including max-age, no-cache, and no-store.
RFC 9110, HTTP Semantics defines conditional requests that allow a server to confirm a stored response with a 304 Not Modified status.
RFC 5861, HTTP Cache-Control Extensions for Stale Content defines bounded reuse of stale responses through stale-while-revalidate and stale-if-error.

How do freshness limits work?

A freshness lifetime is the period during which a stored response remains fresh. The response's age measures time since generation or successful validation with the original server. RFC 9111 calculates freshness by comparing that age with the freshness lifetime.

A private cache serves a single user; a shared cache serves multiple users. max-age supplies a lifetime in seconds. For a shared cache, s-maxage takes precedence over max-age and the Expires header. Otherwise, max-age takes precedence over Expires. Without an explicit lifetime, heuristic freshness is possible under the RFC's conditions.

The Age response header reports estimated age in seconds. Freshness therefore depends on time already elapsed, including time spent in upstream caches. Receiving a response does not restart its freshness lifetime.

Which directives control storage and reuse?

RFC 9111's response directives distinguish several controls. The forms below have no arguments:

Cache-Control: no-cache

no-cache allows storage but requires successful validation before another request can use the response. no-store prohibits a cache from storing the request or response and from reusing that response.

private prevents shared-cache storage while allowing a private cache to store the response under the other applicable rules. must-revalidate requires successful validation once the response becomes stale. A disconnected cache must return an error instead of reusing that stale response.

How does validation avoid a full transfer?

A validator identifies a stored version or its modification time. An entity tag is a version identifier carried in ETag. RFC 9110 describes sending stored entity tags in an If-None-Match request header. Its examples include:

If-None-Match: "xyzzy"

A matching stored version can produce a 304 Not Modified response. That response carries headers for identifying or updating the stored response, without transferring its content again. If-Modified-Since provides a date-based alternative, typically using the stored Last-Modified value.

For a website, examining these request and response headers reveals whether a repeated fetch validates an existing copy or transfers content again.

When can a stale response still be served?

Stale means the response has reached its freshness limit. RFC 5861, an Informational RFC published in May 2010, gives this example:

Cache-Control: max-age=600, stale-while-revalidate=30

The response remains fresh for 600 seconds. A cache may then serve it stale for up to another 30 seconds while attempting validation in the background. Validation depends on a request arriving within that window.

The same document defines stale-if-error as a bounded allowance for serving an older response when an error occurs. These extensions allow stale reuse under specified conditions; the response's freshness lifetime remains unchanged.

FAQ

Does max-age force a page to refresh on screen?

No. RFC 9111 states that freshness governs cache operation. It cannot force your browser to refresh its display or reload a resource.

Does stale-while-revalidate schedule a refresh without traffic?

RFC 5861 describes validation triggered by a request during the stale reuse window. If your page receives no request during that interval, the background validation may never start.

Sources

Check how a page reads to answer engines. Open the GEO score analyzer