A layered approach to browser, CDN and application caching without serving stale personalised or legally sensitive content.
Classify content before caching
Start with public immutable assets, public HTML, frequently changing API data and private user responses. Each class needs a different policy. A single aggressive rule can cache account data; a single conservative rule can make every global visitor wait on the origin. The practical review should record the route, device class, network assumption, cache state and consent state. Teams should keep a baseline trace and a short decision log, because otherwise a later improvement cannot be separated from traffic mix or infrastructure change. The safest implementation is usually the one that reduces hidden work and leaves a clear fallback. Review it at an intermediate viewport as well as desktop and mobile, then repeat the primary task with keyboard input and a cold cache. Capture the result in a form that another engineer can reproduce without access to the original conversation. Include observed evidence, rejected alternatives, operational risk and the signal that triggers rollback. After release, compare both fast and slow percentiles; a median improvement can conceal a worse experience for visitors on constrained devices. Revisit the decision when product behaviour, vendors or traffic distribution changes, because a sound budget is a maintained boundary rather than a one-time audit artifact.
Use names for immutable assets
Hashed filenames allow year-long browser and CDN caching because a content change produces a new URL. Keep HTML lifetimes shorter so it can reference new assets. Do not overwrite immutable URLs in place; that creates inconsistent clients behind layered caches. The practical review should record the route, device class, network assumption, cache state and consent state. Teams should keep a baseline trace and a short decision log, because otherwise a later improvement cannot be separated from traffic mix or infrastructure change. The safest implementation is usually the one that reduces hidden work and leaves a clear fallback. Review it at an intermediate viewport as well as desktop and mobile, then repeat the primary task with keyboard input and a cold cache. Capture the result in a form that another engineer can reproduce without access to the original conversation. Include observed evidence, rejected alternatives, operational risk and the signal that triggers rollback. After release, compare both fast and slow percentiles; a median improvement can conceal a worse experience for visitors on constrained devices. Revisit the decision when product behaviour, vendors or traffic distribution changes, because a sound budget is a maintained boundary rather than a one-time audit artifact.
Separate freshness from availability
Stale-while-revalidate can return a recent response while the CDN refreshes it. Stale-if-error can preserve a public article during an origin incident. Set bounds deliberately and avoid these directives where outdated legal, price or safety information would be harmful. The practical review should record the route, device class, network assumption, cache state and consent state. Teams should keep a baseline trace and a short decision log, because otherwise a later improvement cannot be separated from traffic mix or infrastructure change. The safest implementation is usually the one that reduces hidden work and leaves a clear fallback. Review it at an intermediate viewport as well as desktop and mobile, then repeat the primary task with keyboard input and a cold cache. Capture the result in a form that another engineer can reproduce without access to the original conversation. Include observed evidence, rejected alternatives, operational risk and the signal that triggers rollback. After release, compare both fast and slow percentiles; a median improvement can conceal a worse experience for visitors on constrained devices. Revisit the decision when product behaviour, vendors or traffic distribution changes, because a sound budget is a maintained boundary rather than a one-time audit artifact.
Design purge keys
Purging an entire site for one article wastes cache warmth. Tag responses by content item, template and locale so publishing can invalidate the smallest safe group. Test purge propagation and monitor cache age; an API acknowledgement does not prove every edge updated. The practical review should record the route, device class, network assumption, cache state and consent state. Teams should keep a baseline trace and a short decision log, because otherwise a later improvement cannot be separated from traffic mix or infrastructure change. The safest implementation is usually the one that reduces hidden work and leaves a clear fallback. Review it at an intermediate viewport as well as desktop and mobile, then repeat the primary task with keyboard input and a cold cache. Capture the result in a form that another engineer can reproduce without access to the original conversation. Include observed evidence, rejected alternatives, operational risk and the signal that triggers rollback. After release, compare both fast and slow percentiles; a median improvement can conceal a worse experience for visitors on constrained devices. Revisit the decision when product behaviour, vendors or traffic distribution changes, because a sound budget is a maintained boundary rather than a one-time audit artifact.
Respect variation
Cookies, authentication, device hints and language headers can explode a cache key. Vary only on data that changes the representation. Prefer URL-based locale and responsive browser features over separate mobile HTML. Strip tracking parameters before they fragment public cache entries. The practical review should record the route, device class, network assumption, cache state and consent state. Teams should keep a baseline trace and a short decision log, because otherwise a later improvement cannot be separated from traffic mix or infrastructure change. The safest implementation is usually the one that reduces hidden work and leaves a clear fallback. Review it at an intermediate viewport as well as desktop and mobile, then repeat the primary task with keyboard input and a cold cache. Capture the result in a form that another engineer can reproduce without access to the original conversation. Include observed evidence, rejected alternatives, operational risk and the signal that triggers rollback. After release, compare both fast and slow percentiles; a median improvement can conceal a worse experience for visitors on constrained devices. Revisit the decision when product behaviour, vendors or traffic distribution changes, because a sound budget is a maintained boundary rather than a one-time audit artifact.
Measure hit quality
A high cache-hit ratio can still hide slow misses or frequently stale content. Track edge hit, shield hit, origin latency, revalidation volume and error fallback. Review by route class and region. Capacity planning should model the miss storm after a large purge. The practical review should record the route, device class, network assumption, cache state and consent state. Teams should keep a baseline trace and a short decision log, because otherwise a later improvement cannot be separated from traffic mix or infrastructure change. The safest implementation is usually the one that reduces hidden work and leaves a clear fallback. Review it at an intermediate viewport as well as desktop and mobile, then repeat the primary task with keyboard input and a cold cache. Capture the result in a form that another engineer can reproduce without access to the original conversation. Include observed evidence, rejected alternatives, operational risk and the signal that triggers rollback. After release, compare both fast and slow percentiles; a median improvement can conceal a worse experience for visitors on constrained devices. Revisit the decision when product behaviour, vendors or traffic distribution changes, because a sound budget is a maintained boundary rather than a one-time audit artifact.
Working checklist
- Name the route, audience and primary task.
- Record cold and warm states.
- Identify the earliest controllable cause.
- Ship a reversible change with an owner.
- Compare the same field population after release.