Performance

Browsers will use heuristic caching, which can be unpredictable. Set explicit cache headers.

Consider code splitting or tree shaking to reduce unused code.

Without an explicit Cache-Control, browsers fall back to heuristic caching (~10% of Last-Modified age). Set `Cache-Control: no-cache` or `max-age=300` for HTML to control freshness explicitly -- prevents stale auth state and SPA shell drift.

Server-Timing exposes backend timing breakdowns to browser DevTools (e.g., `db: 45ms; render: 120ms; cache: 2ms`). Useful for diagnosing slow pages without backend log access. Most modern frameworks (Next.js, Cloudflare Workers, Fastly) emit it automatically; absence on a managed platform usually means telemetry headers are stripped at the edge.

First-load mobile users on cellular networks see meaningful latency improvements with HTTP/3. The QUIC transport collapses TLS + TCP handshakes into one and recovers faster from packet loss.

Brotli is the best text-compression algorithm for general use, ~20% smaller than gzip on average (40% on smaller files). Modern browsers all support it.

The page is served with `Content-Encoding: br` but has no `Vary` header. Without `Vary: Accept-Encoding`, intermediary caches (corporate proxies, ISP caches) may serve the compressed variant to clients that didn't send the matching `Accept-Encoding` -- the client sees garbled bytes. Add `Vary: Accept-Encoding` whenever the response is conditionally compressed.

Asset compression is measured per host, from one HEAD request against a sampled resource. Pages that serve all their JS and CSS from the document's own origin are covered by the document compression check instead.