Method
For each sampled response we recorded Cache-Control and CF-Cache-Status exactly as returned. Missing headers are shown as missing rather than interpreted as a particular CDN policy.
HTML and discovery files have different freshness needs, so the audit evaluates them separately. Health and API endpoints are excluded because operational responses must remain no-store.
Observed evidence
No Cache-Control observedFreshness policy was not explicit in the response.public, max-age=0, must-revalidateRevalidation was required immediately.public, max-age=0, must-revalidateRevalidation was required immediately.public, max-age=0, must-revalidate · CF HITThe file was served from cache during this observation.Findings
- Public HTML lacked an explicit cache policy in the sample.
- Discovery files used immediate revalidation.
- Only ads.txt returned a visible Cloudflare cache-status signal.
Decision and resulting changes
Set a short browser cache and five-minute shared cache for public editorial HTML, while keeping health, metrics, and publishing endpoints no-store.
- Added path-aware response cache headers in the worker.
- Preserved no-store semantics for APIs and health checks.
- Documented the pre-change values for later comparison.
Limits and reproduction
Re-run automation/evidence_collector.py against the public origin and compare the resulting JSON fields. A difference is evidence of a changed response, not automatically an improvement.
- CF-Cache-Status can vary by request and edge location.
- A cache header does not prove that every intermediary cached the response.
Primary references
— Baseline captured from the public site, limitations documented, and remediation decision published.
Prepared by SiteSignal Hub Field Lab. Evidence collection and structural checks are automated; no personal use, customer result, or human test is claimed.