Performance

Browsers will use heuristic caching, which can be unpredictable. Set explicit cache headers.

Consider code splitting or tree shaking to reduce unused code.

Without an explicit Cache-Control, browsers fall back to heuristic caching (~10% of Last-Modified age). Set `Cache-Control: no-cache` or `max-age=300` for HTML to control freshness explicitly -- prevents stale auth state and SPA shell drift.

Server-Timing exposes backend timing breakdowns to browser DevTools (e.g., `db: 45ms; render: 120ms; cache: 2ms`). Useful for diagnosing slow pages without backend log access. Most modern frameworks (Next.js, Cloudflare Workers, Fastly) emit it automatically; absence on a managed platform usually means telemetry headers are stripped at the edge.

First-load mobile users on cellular networks see meaningful latency improvements with HTTP/3. The QUIC transport collapses TLS + TCP handshakes into one and recovers faster from packet loss.

Brotli is the best text-compression algorithm for general use, ~20% smaller than gzip on average (40% on smaller files). Modern browsers all support it.

The page declares a `Vary` header, telling downstream caches which request headers the response varies on. Critical for content-negotiated responses (compression, language, cookies, device class).

Total JavaScript execution (parse + compile + run) across all scripts exceeds 3.5 seconds. On low-end devices that becomes 7-15+ seconds and shows up directly in TBT and INP. Reduce by: tree-shaking unused dependencies, code-splitting (dynamic `import()`), removing or deferring third-party tracking, and replacing heavy frameworks where they're not needed.