Direct answer: Of 25 homepages, only one explicitly allows caching with a positive max-age (300 seconds). Eight send no-store, eight send private or no-cache, and eight have no Cache-Control at all. Expires appears on six sites and is already in the past on all six; four sites send ETag and four send Last-Modified. When compression is requested, 24 of 25 return gzip or Brotli (gzip 23, br 1, none 1), and 22 declare Vary: Accept-Encoding.
This study reads headers and at most 1 KB of body, without decompressing or saving the page; a cache policy is not a performance score.
Method: request compression, read headers only
The study reuses the 25 homepages from study 4 and fetches them serially on 2026-11-03 between 12:40 and 12:41, at least 0.8 s apart, with a research user agent. The request carries Accept-Encoding: gzip, deflate, br; only headers and at most 1 KB of body are read, without decompression.
Of 26 candidate URLs, 25 end with 200; E21 returns 502 three times and is excluded. Three others (502 or SSL EOF on the first attempt) recovered on retry.
| Item | Rule | Boundary |
|---|---|---|
| Cacheable | Cache-Control with positive max-age | Literal values; no cache-hit test |
| no-store | Contains no-store, takes precedence | May be required for personalisation or sessions |
| private / no-cache | Contains private or no-cache, no positive max-age | — |
| Missing | No Cache-Control | Not proof of uncacheability |
| Compression | Content-Encoding actually returned | Level and decompressed size not tested |
| Expires in the past | Earlier than fetch time | Only the six present values judged |
Result: cache policy is mostly “not shareable”
| Cache-Control policy | Sites | Share of 25 |
|---|---|---|
| no-store | 8 | 32.0% |
| private or no-cache (no positive max-age) | 8 | 32.0% |
| Missing | 8 | 32.0% |
| Positive max-age (300 seconds) | 1 | 4.0% |
“Missing” is not the same as “uncacheable”: shared caches may apply heuristic freshness. But without an explicit lifetime, the CDN and browser decide for themselves. The eight no-store sites explicitly forbid storage.
| Item | Sites | Note |
|---|---|---|
| max-age present | 2 | One 300 s, one 0 |
| Expires | 6 | All earlier than fetch time |
| ETag | 4 | 16.0% |
| Last-Modified | 4 | 16.0%, matching study 26 |
Without ETag or Last-Modified, a cache can only guess when to refetch. This matches the study 26 finding that 21 of 25 homepages lack Last-Modified.
Compression: 24 of 25 compress, Brotli only once
| Content-Encoding | Sites | Share of 25 |
|---|---|---|
| gzip | 23 | 92.0% |
| br (Brotli) | 1 | 4.0% |
| None | 1 | 4.0% |
| deflate | 0 | 0% |
| Transfer item | Sites | Note |
|---|---|---|
| Vary includes Accept-Encoding | 22 | 88.0% |
| Vary missing | 3 | Compression may still be returned, but caches cannot separate variants |
| Transfer-Encoding: chunked | 16 | — |
| Content-Length | 9 | Complementary with chunked, 25 in total |
| CDN marker (X-Cache/Via) | 2 | Header-name detection only |
Compression is nearly universal: with Accept-Encoding in the request, 24 sites return compressed content. The difference is the algorithm: 23 use gzip only and one returns Brotli. The three sites without Vary may let a shared cache serve a compressed variant to a client that does not accept it.
What this means for acceptance
- State the homepage cache policy explicitly. Only one of 25 gives a positive max-age; eight explicitly send no-store.
- Separate no-store from missing. no-store is a decision; missing leaves it to the cache.
- Check validators with date headers. Only four sites have ETag and four have Last-Modified; without either, revalidation is time-based only.
- Vary must follow compression. 22 sites declare Accept-Encoding and three do not; a compressed variant must be distinguishable in caches.
- Brotli is still an option. Of 24 compressed sites only one uses br; the rest are gzip. Whether to enable it depends on CDN and client support.
Limits
- Single request: fetched once on 2026-11-03 12:40–12:41; CDNs and WAFs may vary by region or time.
- Headers only: real browser and intermediary cache hit rates are not measured, nor compressed byte size.
- no-store may be right: sessions, personalisation or compliance can justify it; this study does not judge intent.
- Missing is not uncacheable: shared caches may use heuristics; the study only records whether the site gave an explicit instruction.
- 25-site pilot: no industry claim.
Data and reproduction
Anonymised data: equipment-cache-compression-2026.csv (25 rows × 15 columns: raw Cache-Control, policy class, max-age, Expires, ETag, Last-Modified, Vary, Content-Encoding, chunked, Content-Length, CDN markers). The repository keeps docs/research/2026-11-cache-compression.csv.
Parser: scripts/cache_compression_probe.py; unit tests: scripts/test_cache_compression_probe.py (10 tests, no network). Run:
python -m unittest scripts.test_cache_compression_probe
Related: the HTTP date header pilot, the homepage security header pilot, and the homepage performance proxy pilot.
Sources and definitions
- Homepage sample: the 25 homepages from study 4 (same sample_id).
- Fetch: 2026-11-03 12:40–12:41 Asia/Shanghai, serial, ≥0.8 s apart.
- Request header: Accept-Encoding: gzip, deflate, br; headers and at most 1 KB of body read.
- Policy classes and compression labels follow the literal response headers.