Cache-Control
Directs browsers, proxies, and CDNs on whether and how long to cache a response: important to get right on pages carrying sensitive data.
What it does
Cache-Control governs caching behaviour for a response: whether it can be stored at all, by whom (private browser cache vs. shared proxies/CDNs), and for how long before it must be revalidated.
Why it matters
This header cuts both ways. For static assets, aggressive caching is a performance win. But for pages containing account details, tokens, or any personal data, an absent or overly permissive Cache-Control can leave sensitive responses sitting in a shared cache, a browser's disk cache on a shared computer, or an intermediate proxy: accessible to the next person who hits the back button or shares that machine.
Recommended value
For authenticated or sensitive pages:
For public, static assets that rarely change (versioned JS/CSS bundles, images):
Domain Flock flags a missing Cache-Control as worth a second look rather than a hard failure: the right value depends entirely on whether the page in question is public or carries anything user-specific.