# Caching and security

## Caching

A rendered page is kept in the edge cache for a day, keyed by the version and by what changes the page: the theme, the embed, the free plan's credit, search-engine indexing, downloads, Try it and published collections. A new push is a new version and a new key, so there's nothing to purge.

Whether the reference is published is read from the database before the cache, on every request. Unpublishing takes effect at once, and no page is kept by a browser or a CDN: each response says `cache-control: no-store`.

Members' pages in the workspace show every shared collection as it's saved, so they aren't cached.

## The daily render cap

A page that isn't in the cache is rendered, and each project has a daily number of renders: see [Plans and limits](../get-started/plans-and-limits#reference). Cached pages keep serving past the cap. A page that would need a render past it answers `503` with a `retry-after` header, the seconds until the cap resets at midnight UTC.

## The content security policy

Each response gets its own policy, with a fresh nonce for its one script:

| Directive | Value | What it means |
| --- | --- | --- |
| `default-src` | `'none'` | Nothing loads unless a directive below allows it. |
| `style-src` | `'self'` | Only our own stylesheet. |
| `script-src` | `'nonce-…'` | Only the page's own script, with this response's nonce. |
| `img-src` | `'self'` | Only our own images. |
| `connect-src` | `'self'` and your servers | With Try it on: the `https` servers your document lists, if they pass the same checks as hosted MCP's hosts. |
| `base-uri` | `'none'` | No `base` element can redirect links. |
| `form-action` | `'none'` | No form can post anywhere. |
| `frame-ancestors` | `'none'`, or `*` on the embed | Only the embed can be framed. |

A server URL that points at an IP address, a private name or latitude10.tech is left out of `connect-src`, so Try it can't call it.

## Other headers

| Header | Value |
| --- | --- |
| `x-content-type-options` | `nosniff` |
| `referrer-policy` | `strict-origin-when-cross-origin` |
| `cache-control` | `no-store` |
| `x-robots-tag` | `noindex`, on a hidden reference and on older versions |

## Where this comes from

- `app/r/_lib/respond.ts`
- `app/reference/_lib/access.ts`
- `app/reference/_lib/usage.ts`
- `app/reference/_lib/page.ts`
- `app/reference/_lib/playground/csp.ts`
- `app/r/[ws]/[project]/route.ts`