Performance

Browsers will use heuristic caching, which can be unpredictable. Set explicit cache headers.

Set explicit width and height to prevent CLS.

Consider code splitting or tree shaking to reduce unused code.

Without an explicit Cache-Control, browsers fall back to heuristic caching (~10% of Last-Modified age). Set `Cache-Control: no-cache` or `max-age=300` for HTML to control freshness explicitly -- prevents stale auth state and SPA shell drift.

Server-Timing exposes backend timing breakdowns to browser DevTools (e.g., `db: 45ms; render: 120ms; cache: 2ms`). Useful for diagnosing slow pages without backend log access. Most modern frameworks (Next.js, Cloudflare Workers, Fastly) emit it automatically; absence on a managed platform usually means telemetry headers are stripped at the edge.

First-load mobile users on cellular networks see meaningful latency improvements with HTTP/3. The QUIC transport collapses TLS + TCP handshakes into one and recovers faster from packet loss.

Brotli is the best text-compression algorithm for general use, ~20% smaller than gzip on average (40% on smaller files). Modern browsers all support it.

The page declares a `Vary` header, telling downstream caches which request headers the response varies on. Critical for content-negotiated responses (compression, language, cookies, device class).

Asset compression is measured per host, from one HEAD request against a sampled resource. Pages that serve all their JS and CSS from the document's own origin are covered by the document compression check instead.