Cloudflare Origin Cache Control: A Guide for Website Owners
Learn how Cloudflare Origin Cache Control uses your origin’s Cache-Control headers, what common directives mean, and how to choose settings for each page.
Facts that can change should include a source and check date. Benchmark claims should state the plan, region, method, and test period.
Cloudflare Origin Cache Control determines how Cloudflare follows the Cache-Control header returned by your origin server—the server that stores or generates your site’s content. For each page or file, decide whether it is public, private, or sensitive, send an appropriate header from the origin, and then review Cloudflare Cache Rules and default policies because they can augment or override origin headers. Typical starting points are public, max-age=86400 for public content, private, max-age=3600 when only a browser should cache the response, and no-store when caches should not retain it.
What the directives mean#
The header describes how a response may be stored and reused by browsers and shared caches. Common directives have different purposes:
| Directive | Meaning |
|---|---|
public, max-age=86400 | Allows a public response to be cached for 86,400 seconds. |
private, max-age=3600 | Allows browser caching for 3,600 seconds but tells shared caches not to store the response. |
no-store | Tells caches not to retain the response; this is appropriate for sensitive content. |
no-cache | Allows storage but requires revalidation with the origin before the cached response is used. |
s-maxage | Sets a freshness period for shared caches separately from the browser’s max-age. |
Use public only when the same response can be served to multiple visitors. Use private when a visitor’s browser may reuse the response but a shared cache should not. Use no-store when the response should not be retained. If storage is acceptable but the origin must be checked before reuse, no-cache expresses that requirement.
Cloudflare-specific behavior#
When Origin Cache Control is enabled, Cloudflare documents that max-age=0 and no-cache may still be cached and revalidated. In this context, no-cache should not be treated as a synonym for no-store, and max-age=0 does not necessarily mean that Cloudflare will retain nothing.
Cloudflare Cache Rules can augment or override origin headers, and Cloudflare’s default policies can also affect the result. The Cache-Control header sent by the origin is therefore one part of the configuration rather than an unconditional description of what Cloudflare will do.
A practical setup process#
- Classify each page or file as public, private, or sensitive based on who may receive the same response and whether it may be retained.
- Configure the origin server or application to send the matching
Cache-Controlheader. - Review Cloudflare Cache Rules and default policies for URL-specific behavior or settings that change the origin instruction.
- Check a representative response’s returned
Cache-Controlheader and compare it with the applicable Cloudflare configuration. Treat the header as the origin’s instruction, then account for any documented Cloudflare rule or policy that changes it. - Revisit the header and related rules when the content’s privacy or acceptable freshness period changes.
These directives and interactions describe Cloudflare’s documented behavior. Other hosting or CDN providers may interpret cache headers or apply override rules differently.
Sources
- Cloudflare: Origin Cache Control Checked 2026-09-24
- Cloudflare cache documentation Checked 2026-09-24