Header Security
Cache Policy Check (Cache-Control, Pragma, Expires)
A misconfigured cache policy can store sensitive data. Learn how to set Cache-Control, Pragma, and Expires headers to balance performance and security.
What this test checks
This test checks the configuration of HTTP cache headers (Cache-Control, Pragma, Expires). An improper cache policy may store sensitive data in the user's browser or in proxies, exposing session or personal information. Conversely, an overly restrictive cache can degrade your site's performance.
Our recommendation
Configure cache headers with appropriate values. For sensitive pages, use 'Cache-Control: no-cache, no-store, must-revalidate'. For static assets (images, CSS, JS), use 'Cache-Control: max-age=86400' with file versioning to force cache renewal. Check your configuration with online tools like GTmetrix.
Security tests
Read more
Server Configuration