A one-year TTL the site was afraid to set

A one-year TTL the site was afraid to set

A fintech app in London capped TTLs at one hour on everything, including hashed JS and CSS bundles like app.4f9a2c.js. The fear was stale code shipping to users. The cost was every hashed asset re-fetching from a Virginia origin twelve times a day for no reason, since a hashed file never changes.

We set Cache-Control: max-age=31536000, immutable on fingerprinted assets and kept short TTLs only on HTML. Because the filename changes on every deploy, a new bundle is a new URL: long caching and instant deploys both, no contradiction.

Cache-hit ratio on static assets went 84% to 99.8%. Origin requests for JS and CSS fell 96%. Repeat-visit load times dropped because browsers and edge both held assets for good.

The number that mattered: one hour TTL became one year, safely.