Apache · Configuration and operations
How does caching work in Apache and what should you cache?
Short answer
Apache can cache with mod_cache plus a storage backend such as mod_cache_disk, while mod_expires and mod_headers control browser and intermediary caching. Cache only safe, shareable responses and respect authorization and Vary.
There are two layers. Client and intermediary caching is controlled by response headers such as Cache-Control, Expires, ETag and Last-Modified. Server-side caching is implemented by mod_cache, which stores responses in memory or on disk and serves them without hitting the backend. These solve different problems and are often used together.
LoadModule cache_module modules/mod_cache.so
LoadModule cache_disk_module modules/mod_cache_disk.so
CacheEnable disk "/static/"
CacheRoot /var/cache/apache2/mod_cache_disk
CacheDirLevels 2
CacheDirLength 1
CacheDefaultExpire 3600
CacheMaxExpire 86400
CacheLock on
<Location "/static">
ExpiresActive On
ExpiresDefault "access plus 1 year"
Header set Cache-Control "public, immutable, max-age=31536000"
</Location>Rules that prevent incidents
- Never cache authenticated responses unless the response is explicitly public and safe to share
- Respect Vary, especially Accept-Encoding and Origin
- Use CacheLock to prevent a thundering herd on a cold object
- Give static assets content-hashed names so long max-age is safe
- Keep dynamic HTML short-lived or uncached unless you can invalidate it
- Purge or version objects when content changes; a cache you cannot invalidate is a liability
A common failure is caching a personalized page because the backend omitted Cache-Control or Set-Cookie. Shared caches should not store responses with Set-Cookie or Authorization unless explicitly permitted. Audit cached responses for those headers and for Vary correctness.
Follow-ups you should expect
Interviewers use these to check whether the first answer was understanding or memorisation.
- 1What is the difference between mod_cache and mod_expires?
- 2When is it unsafe to cache a response?
- 3What does CacheLock protect against?
- 4How do you invalidate a cached object?
Say it in the interview
I separate browser caching from server-side caching. Expires and Cache-Control handle clients and proxies, while mod_cache with a disk or shared-memory backend stores responses on the server. I only cache safe shared content, respect Vary and authorization, and make sure I can invalidate or version objects. The biggest risk is caching a personalized response, so I audit for Set-Cookie and private directives.
Use this as a model, not a script. Saying it in your own words is what makes it survive follow-up pressure.
Related questions
Reading is step one
Now say it out loud.
Understanding an answer and delivering it under pressure are different skills. Rehearse this topic in a live Apache mock interview and get scored feedback on depth, clarity and confidence.