Performance

Browsers will use heuristic caching, which can be unpredictable. Set explicit cache headers.

The main HTML document is served without compression. The Text Compression section above lists the broader picture; for the main response specifically, even gzip would shave ~70-80% off most text payloads.

Without an explicit Cache-Control, browsers fall back to heuristic caching (~10% of Last-Modified age). Set `Cache-Control: no-cache` or `max-age=300` for HTML to control freshness explicitly -- prevents stale auth state and SPA shell drift.

Server-Timing exposes backend timing breakdowns to browser DevTools (e.g., `db: 45ms; render: 120ms; cache: 2ms`). Useful for diagnosing slow pages without backend log access. Most modern frameworks (Next.js, Cloudflare Workers, Fastly) emit it automatically; absence on a managed platform usually means telemetry headers are stripped at the edge.

Consider code splitting or tree shaking to reduce unused code.

First-load mobile users on cellular networks see meaningful latency improvements with HTTP/3. The QUIC transport collapses TLS + TCP handshakes into one and recovers faster from packet loss.

The page declares a `Vary` header, telling downstream caches which request headers the response varies on. Critical for content-negotiated responses (compression, language, cookies, device class).

Each `<script src=...>` without `async`, `defer`, or `type="module"` blocks HTML parsing while the browser fetches and executes it. The block lasts the entire round-trip + execution time -- on slow networks this translates directly into LCP delay. Add `defer` (executes after parse, in source order) for scripts that interact with the DOM, or `async` (executes whenever ready) for analytics / independent scripts. Module scripts (`type="module"`) are deferred by default.