Pragma: a deprecated header still copied everywhere
Pragma is a leftover from HTTP/1.0 with one defined value, no-cache. It is deprecated, it has no meaning on a response, and Cache-Control replaced it completely.
At a glance
- Direction
- Defined for requests. As a response header it has no specified meaning at all.
- Defined in
- RFC 9111, which lists it as deprecated
- When absent
- Nothing changes. Cache-Control carries every directive a current cache honours.
- Only defined value
- no-cache, equivalent to Cache-Control: no-cache in a request
- Status
- Deprecated. Provided for compatibility with HTTP/1.0 caches only.
- On responses
- Undefined behaviour. It does not stop anything being stored.
- Replacement
- Cache-Control, on both requests and responses
In detail
Pragma predates Cache-Control. In HTTP/1.0 it was the way a client could force an intermediary to revalidate rather than serve a stored copy, and no-cache was the only value anyone implemented. When HTTP/1.1 introduced Cache-Control, the older header was kept purely so that HTTP/1.0 caches on the path would still understand a request that wanted fresh content.
The important detail is that it was only ever specified for requests. Sending Pragma: no-cache on a response has never had a defined effect, which does not stop it appearing in thousands of configuration files as a supposed extra guarantee that a page will not be cached. It is not a guarantee, and a response relying on it is uncached only by luck.
RFC 9111 is explicit that the header is deprecated, and tells servers to use Cache-Control instead. Current caches read Cache-Control, and where both are present on a request the Cache-Control directive wins. There is no configuration in which Pragma changes the outcome for a modern client.
You will still meet it in compliance checklists and legacy templates. Leaving the line in place costs a few bytes and confuses the next reader; removing it changes nothing measurable. What matters is that the Cache-Control header next to it actually says what you meant, usually no-store rather than no-cache.
Examples
Cache-Control: no-store, no-cache, must-revalidate
Pragma: no-cache
Expires: 0Only the Cache-Control line has any effect in a current browser or shared cache.
GET /dashboard HTTP/1.1
Cache-Control: no-cache
Pragma: no-cacheThings that catch people out
- Adding Pragma: no-cache to a response does not stop it being stored. If that is the requirement, the answer is Cache-Control: no-store.
- Some security scanners still report a missing Pragma header as a finding, which pushes teams to add a deprecated header that changes nothing.
- It carries no other directives. Pragma: no-store or Pragma: private are invented values that every cache ignores.
Try it: HTTP Headers Checker
Check a live URL or paste headers you already have. It grades six security headers from A+ to F and lists every other header the response returned.
HTTP Headers Checker
LOCAL · Browser-OnlyView HTTP response headers for any URL
Enter any website URL to fetch and analyze its HTTP response headers. We'll automatically add https:// if needed.
Why Check Security Headers?
Security headers protect your website against common attacks like XSS, clickjacking, and MIME sniffing. They're set by your web server and cost nothing to implement. Missing security headers are one of the most common findings in security audits.
Related HTTP headers
All http headers →Cache-Control: directives for browsers and shared caches
Every Cache-Control directive that matters, the difference between no-cache and no-store, and how to cache immutable assets forever without breaking deploys.
Expires: the older way to set a freshness lifetime
What Expires does, why Cache-Control max-age overrides it, what an invalid date such as 0 means to a cache, and whether it is still worth sending.
Age: how long a cached response has been sitting there
What the Age header counts, how it combines with max-age to give remaining freshness, and how to use it to tell a cache hit from a miss at the edge.
Date: when the response was generated
What the Date header records, the exact GMT format required, how caches use it with Age and max-age, and the one case where a server may omit it.
Accept: asking for a media type, with preferences
How the Accept header expresses preferences with q values, how servers pick a representation, and what to return when nothing on the list can be produced.
Accept-Encoding: negotiating gzip, br and zstd
Which compression tokens clients send, how identity and the wildcard behave, why the response needs Vary, and how to test whether compression is really on.
Tools for this
- HTTP Headers Checker Free online HTTP headers checker - view HTTP response headers for any URL
- HTTP Request Builder Free online HTTP request builder - build and test HTTP requests with custom headers and body