Help center

Home Web Performance Optimisation (WPO)[WPO-009] Set safe caching for public HTML and private content

Web Performance Optimisation (WPO)7 min•Difficulty: Avanzado

[WPO-009] Set safe caching for public HTML and private content

Avoid recomputing every public visit or storing a response containing another account's data.

Ingeniería de Rendimiento AnayilUpdated: 2026-10-10

Apply this guide to your situation

This answer covers “[WPO-009] Set safe caching for public HTML and private content”. Read it with the summary and confirm that the symptom and service match what you are experiencing. Available options can vary by plan and account setup.

Before changing anything, note what you expected, what happened and roughly when. Check whether the issue affects one page or the whole service.
Save the full error message and note recent changes. Hide passwords, access codes, personal data and keys before sharing screenshots or logs.
If a step requires administrator access, restarting services or editing server files, stop if you do not administer that server. Send support the service name, error and checks you have already made.

L3 technical diagnosis

Performance / configurationSeverity: Medium; high if conversion or availability is affected

User symptoms

Public pages always reach the origin, or in the worst case the wrong session's content appears.

Observed code or message

`Cache-Control: no-store` on public pages or a private response served as a shared HIT

Likely root cause

A global policy can disable caching for public content; ignoring cookies, authorization or response variation can mix sessions and expose data.

Likely-cause and resolution matrix

Follow a branch only when evidence supports it. A symptom may have more than one cause; do not change layers by guesswork.

01Professional English translation pending.

Why it can happen: Professional English translation pending.

How to diagnose (read-only):

bash

Professional English translation pending.

Step-by-step resolution:
Professional English translation pending.

02Professional English translation pending.

Why it can happen: Professional English translation pending.

How to diagnose (read-only):

bash

Professional English translation pending.

Step-by-step resolution:
Professional English translation pending.

03Professional English translation pending.

Why it can happen: Professional English translation pending.

How to diagnose (read-only):

bash

Professional English translation pending.

Step-by-step resolution:
Professional English translation pending.

04Professional English translation pending.

Why it can happen: Professional English translation pending.

How to diagnose (read-only):

bash

Professional English translation pending.

Step-by-step resolution:
Professional English translation pending.

05Professional English translation pending.

Why it can happen: Professional English translation pending.

How to diagnose (read-only):

bash

Professional English translation pending.

Step-by-step resolution:
Professional English translation pending.

Prerequisites

Authorised access to the affected site, repository or service metrics.
A reproducible URL and timestamp; use staging for infrastructure changes.
A backup or rollback method for configuration and deployments.

Important warnings

Inspection commands do not authorise production changes. Do not run load tests or global purges without an approved plan.
Never store private responses in shared caches. Server changes in Anayil Panel depend on the controls available for the service and may require its administrator/provider.

Step-by-step walkthrough

1. Reproduce and narrow the issue

Public pages always reach the origin, or in the worst case the wrong session's content appears. Inspect anonymous and authenticated response headers. Check `Cache-Control`, `Vary`, `Set-Cookie`, `Age` and the CDN HIT/MISS indicator.

bash

curl -sSI https://example.com/
curl -sSI -H 'Cookie: session=REDACTED' https://example.com/account

Expected output:

`Cache-Control: no-store` on public pages or a private response served as a shared HIT

2. Apply the appropriate correction

Separate public routes from account/API routes. Apply public policy only to shareable content and `private`/`no-store` according to sensitivity; do not strip `Set-Cookie` or ignore `Authorization` to force HIT. Ask the cache operator/provider to apply and review the rule.

3. Verify the experience

Test anonymously and then with two test accounts. Public pages may reuse cache according to policy; data or cookies from separate sessions must never cross.

Expected output:

The improvement is reproducible on the affected route and profile with no new functional errors.

Troubleshooting & Solutions

`Cache-Control: no-store` on public pages or a private response served as a shared HIT

Root cause: A global policy can disable caching for public content; ignoring cookies, authorization or response variation can mix sessions and expose data.

Resolution: Separate public routes from account/API routes. Apply public policy only to shareable content and `private`/`no-store` according to sensitivity; do not strip `Set-Cookie` or ignore `Authorization` to force HIT. Ask the cache operator/provider to apply and review the rule.

Rollback and recovery plan

Roll back only the changed directive, dependency or release using the recorded value. If 5xx errors, data exposure or session failures occur, have the operator disable the new rule and retain redacted logs for analysis.

Related runbooks in this category:

[WPO-001] Separate origin latency from browser delay7 min [WPO-002] Diagnose intermittent latency without mislabeling constant slowness7 min [WPO-003] Reduce redirect chains in the page-load path7 min

Was this technical guide helpful?

Facing a production outage?

Hosting Anayil system administrators can directly intervene on your server infrastructure.

Open Support Ticket at Hosting Anayil