Age: how long a cached response has been sitting there
Age is the number of seconds since the response was generated by the origin server. A shared cache adds it, so a non-zero Age means you were served a stored copy.
At a glance
- Direction
- Response only, added by caches rather than by the origin.
- Defined in
- RFC 9111
- When absent
- The response probably came straight from the origin, though not every cache adds the header.
- Unit
- Seconds, as a non-negative integer
- Added by
- Shared caches and reverse proxies, not usually by the origin application
- Remaining freshness
- max-age minus Age, which is what the browser actually has left
- Diagnostic value
- Age: 0 or no header on every request means nothing is being cached.
In detail
The number is an estimate of how long ago the origin produced this body, accumulated across every cache the response passed through. A response with max-age=600 and Age: 540 is fresh for one more minute, not ten, which is the calculation people miss when they wonder why a browser revalidates far sooner than the max-age suggests.
As a diagnostic it is the quickest cache hit indicator you have. Request the same URL twice: if the second response has a larger Age, an intermediary served it from storage. If Age stays at zero or never appears, either nothing is caching the response or every request is reaching the origin, and the Cache-Control and Vary headers are where to look next.
It is also how you spot a cache holding on to something too long. An Age approaching an enormous max-age on a page that is supposed to change daily usually means a purge never happened, or that the URL is being cached under a key you did not expect.
The origin can send the header itself, but there is rarely a reason to. Leave it to the caches on the path, since a hand written Age immediately shortens the remaining freshness of a response that has not actually been stored anywhere, and it makes the one diagnostic the header is good for, telling a hit from a miss, useless for everyone downstream.
Examples
HTTP/1.1 200 OK
Cache-Control: public, max-age=600
Age: 60
Date: Mon, 03 Feb 2025 10:00:00 GMTcurl -sI https://example.com/style.css | grep -i '^age:'
curl -sI https://example.com/style.css | grep -i '^age:'A larger number on the second call means the response was served from a shared cache rather than the origin.
Things that catch people out
- Age counts from generation, not from storage, so a response can arrive already close to stale and revalidate almost immediately.
- Not every cache adds the header. A missing Age is weak evidence of a miss, not proof of one.
- Some edges reset Age when they refresh their own copy, so a low number does not always mean the object is new to the whole chain.
Try it: HTTP Headers Checker
Check a live URL or paste headers you already have. It grades six security headers from A+ to F and lists every other header the response returned.
HTTP Headers Checker
LOCAL · Browser-OnlyView HTTP response headers for any URL
Enter any website URL to fetch and analyze its HTTP response headers. We'll automatically add https:// if needed.
Why Check Security Headers?
Security headers protect your website against common attacks like XSS, clickjacking, and MIME sniffing. They're set by your web server and cost nothing to implement. Missing security headers are one of the most common findings in security audits.
Related HTTP headers
All http headers →Cache-Control: directives for browsers and shared caches
Every Cache-Control directive that matters, the difference between no-cache and no-store, and how to cache immutable assets forever without breaking deploys.
Date: when the response was generated
What the Date header records, the exact GMT format required, how caches use it with Age and max-age, and the one case where a server may omit it.
Expires: the older way to set a freshness lifetime
What Expires does, why Cache-Control max-age overrides it, what an invalid date such as 0 means to a cache, and whether it is still worth sending.
Vary: which request headers change the response
How Vary extends a cache key, why Vary: User-Agent destroys hit rates, what Vary: * means, and the CORS case where forgetting Vary: Origin causes real bugs.
If-None-Match: asking whether anything changed
How If-None-Match produces a 304, why it uses weak comparison, how it overrides If-Modified-Since, and its second job preventing duplicate creates.
If-Modified-Since: date based conditional requests
How If-Modified-Since produces a 304, why it only applies to GET and HEAD, when servers must ignore it, and why entity tags are preferred where both exist.
Tools for this
- HTTP Headers Checker Free online HTTP headers checker - view HTTP response headers for any URL
- HTTP Request Builder Free online HTTP request builder - build and test HTTP requests with custom headers and body