Cache-Control header for HTML
The Cache-Control header on the HTML. It decides how long browsers and CDNs may reuse the response instead of asking for it again.
Cache-Control is the header that tells browsers, CDNs and proxies whether they may keep a copy of a response and for how long. Without it, each cache guesses on its own: some store the page for an unpredictable time, others ask for it again on every visit. Both are bad — the first can show visitors an outdated page after you publish a change, the second makes every visit download the full HTML.
How SiteScan checks it
The scanner reads the headers of the home page HTML and shows the Cache-Control value as it was sent. If there is a Cache-Control or at least an Expires header, the row is green: the server has made a decision. If neither is there, the row says “Missing” and turns amber. A deliberate no-store also counts as a decision.
What to send
For HTML that changes when you publish, a common choice is Cache-Control: no-cache together with an ETag or Last-Modified: the browser keeps a copy but checks with the server before each use, and gets a short 304 if nothing changed. For pages behind a CDN, s-maxage=300 lets the CDN hold the page for five minutes. Static files with a version hash in the name can be cached for a year: max-age=31536000, immutable. Details and examples are in the article on HTTP caching.
See this check on your own site
Run a free scan: the report shows this row for your domain along with the other checks of the site audit.
More in “Delivery & reputation”
What SiteScan checks
TLS certificate
- TLS certificate expiry
- Outdated TLS versions (TLS 1.0/1.1)
- TLS certificate chain
- TLS certificate issuer
- Certificate signature algorithm
Domain registration
- Domain registration expiry
- Registered domain name
- Domain registrar
- Domain registration date
- Domain last updated date
- Domain status codes (EPP)
- Domain transfer lock
- Registrar abuse contact
- RDAP and WHOIS data source
Indexing
- robots.txt file
- CSS and JS blocked in robots.txt
- XML sitemap
- Sitemap index file
- Off-domain URLs in the sitemap
- Sitemap lastmod dates
- Broken URLs in the sitemap
- RSS and Atom feed
Addresses & redirects
Security headers
- HTTP security headers and grade
- Strict-Transport-Security (HSTS) header
- Content-Security-Policy (CSP) header
- X-Content-Type-Options: nosniff
- X-Frame-Options and clickjacking
- Referrer-Policy header
- Permissions-Policy header
- HSTS preload list
- CORS and cross-origin reads
- HTTP TRACE method
Delivery & reputation
- Cache-Control header for HTML
- ETag and Last-Modified revalidation
- HTTP/3 and QUIC support
- Server version disclosure in headers
- DNS blocklist (DNSBL) check
Internal links
Exposure
- Exposed sensitive files (.env, .git, backups)
- Directory listing enabled
- Public JavaScript source maps
- Exposed WordPress endpoints
Well-known files
- security.txt file
- llms.txt for AI assistants
- llms-full.txt file
- ads.txt authorized sellers file
- humans.txt file
- Well-known change-password URL
DNS & email
- MX records (mail servers)
- SPF record
- DMARC record and policy
- DNSSEC signing
- CAA record
- Nameserver redundancy
- IPv6 support (AAAA record)
- MTA-STS policy
- TLS-RPT reporting record
- BIMI record (brand logo in email)
- Wildcard DNS record
- Dangling CNAME and subdomain takeover
Privacy & consent
- Analytics and tracking scripts
- Cookie consent banner
- Privacy policy link
- Terms of service link
- Imprint (Impressum)
- Accessibility statement
Core Web Vitals
- Lighthouse performance score
- Largest Contentful Paint (LCP)
- Cumulative Layout Shift (CLS)
- Interaction to Next Paint (INP)
- CrUX field data vs lab data