ETag and Last-Modified revalidation

ETag and Last-Modified — the headers that let a browser ask whether anything has changed and get a short 304 back instead of the whole page.

• Help center

Validators let a browser ask the server “has this changed since my copy?” instead of downloading the page again. There are two: ETag, an identifier of the current version of the response (often a hash), and Last-Modified, the time of the last change. On the next visit the browser sends them back as If-None-Match or If-Modified-Since. If nothing changed, the server answers 304 Not Modified with no body — a few hundred bytes instead of the whole page.

How SiteScan checks it

The scanner looks for both headers on the home page HTML and lists the ones it found. One of them is enough for a green row. With neither, the row says “Missing” and is amber: every reload transfers the full HTML even when nothing on it has changed. Combined with a missing Cache-Control, the scan also reports that every visit re-downloads the page in full.

How to enable them

Static files usually get both automatically: nginx and Apache send ETag and Last-Modified by default. Dynamic pages are where they go missing. Most frameworks have a switch or middleware for this — for example ETag middleware in Express or conditional GET in Django. Behind a load balancer, make sure the ETag does not differ between servers for the same content, or the 304 never happens. See also the guide to HTTP caching.