Cache and response headers

Edge cache

Switched on or off per service (default on); there is no per-service TTL. The edge keeps responses that the origin marks as cacheable, without private or no-store, up to 5 MB per object and up to 3600 seconds, or shorter if the origin's max-age says so. A hit is served at the edge and skips the WAF; every response carries X-ZP-Cache: HIT or MISS so you can see what the cache does. Control what is cached with the Cache-Control headers your origin sends.

Static origins

With origin_kind: static (a bucket or file server as origin) the edge replaces the origin's 403 and 404 responses with the branded error pages, so S3 error bodies with bucket names and request ids never reach visitors. Edge-generated denials (WAF, rate limits, challenges) keep their own pages in either mode.

Content negotiation

For static sites the edge can serve pre-compressed files: with content_negotiation enabled, a request for app.css with Accept-Encoding: zstd is rewritten to app.css.zst (or .gz for gzip), and Vary: Accept-Encoding is added. File types: css, js, html, json, svg, xml by default. Your deploy must place the compressed variants next to the originals; a negotiated type without one returns 404.

Response headers

Set per service: HSTS (max_age, include_subdomains, preload), X-Frame-Options, X-Content-Type-Options, Referrer-Policy, and CORS rules with origins, methods, headers and max_age_seconds added at the edge.