Caching Score: https://www.arpansa.gov.au/
Request flow
Summary
GradeB+
524/652
Requested URL checks
What is this check, and why should you care
Having a cache hit ensures the fastest possible delivery of content to end users.
The response header X-Cache had a value of TCP_MEM_HIT from a23-40-103-217.deploy.akamaitechnologies.com (AkamaiGHost/22.6.4-888a2d21768272d5e2d80e9762941e76) (-).
Akamai has documentation on how to interpret the X-Cache and X-Cache-Remote headers.
Maximum possible points
100
What is this check, and why should you care
Using a CDN is extremely useful for caching purposes.
Maximum possible points
50
What is this check, and why should you care
The time that it takes for a user's browser to receive the first byte of page content.
The lower the TTFB, the faster your site will be perceived by the end user.
To get maximum points, your TTFB must be less than or equal to 30ms. If your TTFB is more than 1 second then you get no points here.
Maximum possible points
50
What is this check, and why should you care
An ETag is an opaque identifier for a specific version of a resource, defined in RFC 9110 §8.8.3. When a client revisits a URL it can send the previously-seen value back in an If-None-Match request header (RFC 9110 §13.1.2); if the server still considers the response current it returns an empty 304 Not Modified instead of the full body, saving bandwidth and origin work.
An HTTP request with the request header If-None-Match with a value of "1791676067" was sent, and an HTTP 304 was responded with.
Akamai has documentation on how to enable Etag support (requires login).
See the Wikipedia page on ETag for more background.
To get maximum points, you need to have ETag identifiers and an HTTP 304 response must be received when using a valid If-None-Match request header.
Maximum possible points
30
What is this check, and why should you care
The Last-Modified response header carries the date the resource was last changed, defined in RFC 9110 §8.8.2. When a client revisits the URL it can send the previously-seen value back in an If-Modified-Since request header (RFC 9110 §13.1.3); if the resource has not changed the server returns an empty 304 Not Modified instead of the full body, saving bandwidth and origin work.
An HTTP request with the request header If-Modified-Since with a value of Sat, 10 Oct 2026 23:47:47 GMT was sent, and an HTTP 304 was responded with.
Maximum possible points
30
What is this check, and why should you care
Having tiered caching can help improve the cache hit ratio of your site because it provides an additional layer of caching in front of your origin.
Maximum possible points
25
What is this check, and why should you care
Drupal 8+ provides an Internal Page Cache module recommended for small to medium-sized websites.
There is value in using this module, even when you are using Akamai, due to the low cache lifetime of 0 seconds.
To get maximum points, you must enable the page_cache module, and have a HIT on Drupal's page cache.
See Drupal's documentation on the Internal Page Cache module. Also, Wim Leers wrote a really awesome blog post on the release of this module with important background.
Maximum possible points
20
What is this check, and why should you care
Akamai has very strict controls around cache tag lengths, counts and characters. If you exceed or break these controls then you risk your content not being invalidated when you issue a cache tag purge.
No issues were found.
See the Akamai technical documentation on how to interpret this header.
Maximum possible points
10
What is this check, and why should you care
Drupal sets a session cookie (named SESS<hash> over HTTP, or SSESS<hash> over HTTPS) the first time the session is read or written during a request. When a session cookie is present, most reverse proxies and CDNs will bypass their cache entirely for all HTML responses, because the response is considered personalised.
Anonymous page requests should not need a session at all. Contributed modules known to start a session for anonymous users include:
- Smart IP — stores geolocation data in
$_SESSIONfor anonymous users (#1897126). - Flag — starts an anonymous session as part of determining flag actions (#2894095).
- H5P — creates anonymous sessions even for components that don't need it (#3126134).
- Textsize — stores text size preferences in the session (#1041878).
To get maximum points, the response must not include a SESS or SSESS cookie. If it does, identify which module is starting the session and either disable it, reconfigure it, or find an alternative that does not require a session for anonymous users.
Maximum possible points
10
What is this check, and why should you care
CSS aggregation reduces the number of assets your site needs to download. The filename contains a hash of all the file contents, meaning you can cache these files for an extremely long time with no negative consequences.
Maximum possible points
10
What is this check, and why should you care
Javascript aggregation reduces the number of assets your site needs to download. The filename contains a hash of all the file contents, meaning you can cache these files for an extremely long time with no negative consequences.
Maximum possible points
10
What is this check, and why should you care
Drupal 9.5+ introduces a new debug setting to make it easier to debug render caching. This setting will add cache debugging output for each rendered element.
The main issue with this is that this slows down your page loads (on top increasing your page weight).
To get maximum points, you must disable the render cache debug.
Maximum possible points
10
What is this check, and why should you care
Drupal 7+ provides a Statistics module to which records content view statistics in Drupal's database.
The main issue with this module is that it sends an un-cacheable HTTP POST request to your site to record a 'content view' statistic. This does not scale well as you Drupal site gets more traffic.
To get maximum points, you must disable the statistics module.
Maximum possible points
10
What is this check, and why should you care
Drupal 8+ uses Twig for templating, and the Twig template engine offers a debug tool to which emits out a list of template filenames in the HTML source.
The main issue with this is that you often also have other Twig related performance issues as well, e.g. automatic reloading.
To get maximum points, you must disable Twig debug.
Maximum possible points
10
What is this check, and why should you care
You can increase the cache hit rate of your site by stripping certain query parameters from the cache key.
FBCLID is one such parameter that can be stripped by your caching server. This query parameter only really serves a purpose for Javascript to read, and Javascript can still read it from the browser URL.
This check requested the URL https://www.arpansa.gov.au/?fbclid=1791772919.
Maximum possible points
10
What is this check, and why should you care
You can increase the cache hit rate of your site by stripping certain query parameters from the cache key.
GCLID and GCLSRC are two such parameters that can be stripped by your caching server. These query parameters only really serve a purpose for Javascript to read, and Javascript can still read it from the browser URL.
This check requested the URL https://www.arpansa.gov.au/?gclsrc=1791772919&gclid=1791772919.
Maximum possible points
10
What is this check, and why should you care
You can increase the cache hit rate of your site by stripping certain query parameters from the cache key.
TTCLID is one such parameter that can be stripped by your caching server. This query parameter only really serves a purpose for Javascript to read, and Javascript can still read it from the browser URL.
This check requested the URL https://www.arpansa.gov.au/?ttclid=1791772919.
Maximum possible points
10
What is this check, and why should you care
You can increase the cache hit rate of your site by stripping certain query parameters from the cache key.
UTM is a collection of parameters that can be stripped by your caching server. These query parameters only really serve a purpose for Javascript to read, and Javascript can still read them from the browser URL.
This check requested the URL https://www.arpansa.gov.au/?utm_source=1791772919&utm_medium=1791772919&utm_campaign=1791772919&utm_id=1791772919.
Maximum possible points
10
What is this check, and why should you care
There is a SPAM protection module in Drupal called Honeypot.
The honeypot module has a feature that adds a time based hidden form field to forms to protect against bots filling them in too quickly. This is a nice feature, however it happens to disable caching for the entire page. This is terrible for high traffic sites.
It is recommended to disable this time based feature, and only use the core honeypot feature of a hidden input field.
Maximum possible points
5
What is this check, and why should you care
The language_cookie module breaks proxy caching because it makes Drupal’s response vary by a cookie, which most HTTP caches don’t handle efficiently.
The module also has a side effect of breaking Drupal’s page_cache system as well - see the issue #3512070.
To get maximum points, you must disable the language_cookie module.
Maximum possible points
5
What is this check, and why should you care
There are 2 filesystems in Drupal - public files and private files.
Private files force Drupal to bootstrap in order to serve the file, and access control is checked every single time. This is useful for sensitive files, but a hindrance when your site is under high load.
It is recommended to use Drupal's public file system for static, non-sensitive files, and reserve the use of private files for dynamic, or sensitive files.
Maximum possible points
5
What is this check, and why should you care
HTTP compression reduces the size of a response body by eliminating redundancy. The client advertises supported algorithms in the Accept-Encoding request header, and the server reports which one it used in the Content-Encoding response header — both are defined in RFC 9110 §8.4.
The four common encodings each have their own specification: gzip (RFC 1952), deflate (RFC 1951), br / Brotli (RFC 7932), and zstd / Zstandard (RFC 8878). Smaller responses load faster and use less bandwidth, which especially matters on mobile networks.
The response header Content-Encoding had a value of gzip.
Akamai has documentation on how to enable Brotli compression.
See the Wikipedia page on HTTP compression for more background.
To get maximum points, you need to use Brotli or Zstandard compression.
Maximum possible points
20
What is this check, and why should you care
A cached response is reusable for the duration of its freshness lifetime, defined in RFC 9111 §4.2. The freshness lifetime is taken from Cache-Control: s-maxage or max-age (§5.2), and falls back to the Expires header (§5.3) or a heuristic if neither is set. The longer the freshness lifetime, the higher the cache hit ratio at any given traffic level.
To get maximum points, your cache lifetime must be greater than or equal to 4 weeks. If your cache lifetime is less, then you will get some proportion of the score based on how close to 4 weeks you are.
The current cache lifetime is 0 seconds (0 seconds).
Maximum possible points
100
What is this check, and why should you care
HTTP 404 (Not Found) is one of the response status codes that RFC 9110 §15.1 marks as heuristically cacheable, and RFC 9111 §4.2.2 defines the heuristic-freshness rules a cache may apply when no explicit freshness is provided. Caching 404s — even briefly — offloads repeated probes (broken links, scanners, missing assets) from your origin.
To get maximum points, you need to have the ability to cache an HTTP 404 for any amount of time.
This check requested the URL https://www.arpansa.gov.au/cachingscorebrokenurltest.
Maximum possible points
20
Image checks
Performed on the asset: https://www.arpansa.gov.au/sites/default/files/styles/civictheme_slider_slide/public/images/2026-09/04156_Misheye_070825.469.jpg?h=6f98870f&itok=7fqaeNn8
See the HTTP headers for this image file.
What is this check, and why should you care
Having a cache hit ensures the fastest possible delivery of content to end users.
The response header X-Cache had a value of TCP_MEM_HIT from a23-40-103-217.deploy.akamaitechnologies.com (AkamaiGHost/22.6.4-888a2d21768272d5e2d80e9762941e76) (-).
Akamai has documentation on how to interpret the X-Cache and X-Cache-Remote headers.
Maximum possible points
10
What is this check, and why should you care
An ETag is an opaque identifier for a specific version of a resource, defined in RFC 9110 §8.8.3. When a client revisits a URL it can send the previously-seen value back in an If-None-Match request header (RFC 9110 §13.1.2); if the server still considers the response current it returns an empty 304 Not Modified instead of the full body, saving bandwidth and origin work.
An HTTP request with the request header If-None-Match with a value of "6ab369c1-69c2" was sent, and an HTTP 304 was responded with.
Akamai has documentation on how to enable Etag support (requires login).
See the Wikipedia page on ETag for more background.
To get maximum points, you need to have ETag identifiers and an HTTP 304 response must be received when using a valid If-None-Match request header.
Maximum possible points
3
What is this check, and why should you care
The Last-Modified response header carries the date the resource was last changed, defined in RFC 9110 §8.8.2. When a client revisits the URL it can send the previously-seen value back in an If-Modified-Since request header (RFC 9110 §13.1.3); if the resource has not changed the server returns an empty 304 Not Modified instead of the full body, saving bandwidth and origin work.
An HTTP request with the request header If-Modified-Since with a value of Wed, 23 Sep 2026 05:55:13 GMT was sent, and an HTTP 304 was responded with.
Maximum possible points
3
What is this check, and why should you care
A cached response is reusable for the duration of its freshness lifetime, defined in RFC 9111 §4.2. The freshness lifetime is taken from Cache-Control: s-maxage or max-age (§5.2), and falls back to the Expires header (§5.3) or a heuristic if neither is set. The longer the freshness lifetime, the higher the cache hit ratio at any given traffic level.
To get maximum points, your cache lifetime must be greater than or equal to 4 weeks. If your cache lifetime is less, then you will get some proportion of the score based on how close to 4 weeks you are.
The current cache lifetime is 998001 seconds (1 week and 4 days).
Maximum possible points
10
CSS checks
Performed on the asset: https://www.arpansa.gov.au/sites/default/files/css/css_oF5kR8kgFyMK9t-4oXu3NZqIL8H4jeceo4jj5Dmp1fU.css?delta=0&language=en&theme=arpansa&include=eJyN0kGuxCAIBuALaT0TRcaSqhjBTub2r5nF604nMS7gi-YnIF-MdlChkLLskB0-lQwfGaYOpVNAKU0qVdPtId5Dpm5TsQOe3uQ-beFqpb4gyuhRqt2tuRxmUqfkJWKL_w6C-APhmqYmcz0XQOdxsiSZggoXJzBeZG7QIXVox1x1KeIRepwyPbmts2nm1QxVkCF_n5ovm0Fy_xE0xD4a5O2pbKO2sd_TPCg6_ahRCffOkLuY3hq-91Ykjkx_prck-g
See the HTTP headers for this CSS file.
What is this check, and why should you care
Having a cache hit ensures the fastest possible delivery of content to end users.
The response header X-Cache had a value of TCP_MEM_HIT from a23-40-103-217.deploy.akamaitechnologies.com (AkamaiGHost/22.6.4-888a2d21768272d5e2d80e9762941e76) (-).
Akamai has documentation on how to interpret the X-Cache and X-Cache-Remote headers.
Maximum possible points
10
What is this check, and why should you care
An ETag is an opaque identifier for a specific version of a resource, defined in RFC 9110 §8.8.3. When a client revisits a URL it can send the previously-seen value back in an If-None-Match request header (RFC 9110 §13.1.2); if the server still considers the response current it returns an empty 304 Not Modified instead of the full body, saving bandwidth and origin work.
An ETag header is present but does not produce an HTTP 304 response. However a Last-Modified header is also present, which is sufficient for conditional requests. No penalty is applied.
Akamai has documentation on how to enable Etag support (requires login).
See the Wikipedia page on ETag for more background.
To get maximum points, you need to have ETag identifiers and an HTTP 304 response must be received when using a valid If-None-Match request header.
Maximum possible points
3
What is this check, and why should you care
The Last-Modified response header carries the date the resource was last changed, defined in RFC 9110 §8.8.2. When a client revisits the URL it can send the previously-seen value back in an If-Modified-Since request header (RFC 9110 §13.1.3); if the resource has not changed the server returns an empty 304 Not Modified instead of the full body, saving bandwidth and origin work.
An HTTP request with the request header If-Modified-Since with a value of Tue, 29 Sep 2026 21:01:39 GMT was sent, and an HTTP 304 was responded with.
Maximum possible points
3
What is this check, and why should you care
HTTP compression reduces the size of a response body by eliminating redundancy. The client advertises supported algorithms in the Accept-Encoding request header, and the server reports which one it used in the Content-Encoding response header — both are defined in RFC 9110 §8.4.
The four common encodings each have their own specification: gzip (RFC 1952), deflate (RFC 1951), br / Brotli (RFC 7932), and zstd / Zstandard (RFC 8878). Smaller responses load faster and use less bandwidth, which especially matters on mobile networks.
The response header Content-Encoding had a value of br.
Akamai has documentation on how to enable Brotli compression.
See the Wikipedia page on HTTP compression for more background.
To get maximum points, you need to use Brotli or Zstandard compression.
Maximum possible points
2
What is this check, and why should you care
A cached response is reusable for the duration of its freshness lifetime, defined in RFC 9111 §4.2. The freshness lifetime is taken from Cache-Control: s-maxage or max-age (§5.2), and falls back to the Expires header (§5.3) or a heuristic if neither is set. The longer the freshness lifetime, the higher the cache hit ratio at any given traffic level.
To get maximum points, your cache lifetime must be greater than or equal to 4 weeks. If your cache lifetime is less, then you will get some proportion of the score based on how close to 4 weeks you are.
The current cache lifetime is 1571731 seconds (2 weeks and 4 days).
Maximum possible points
10
JavaScript checks
Performed on the asset: https://www.arpansa.gov.au/core/assets/vendor/jquery/jquery.min.js?v=4.0.0
See the HTTP headers for this JavaScript file.
What is this check, and why should you care
Having a cache hit ensures the fastest possible delivery of content to end users.
The response header X-Cache had a value of TCP_MEM_HIT from a23-40-103-217.deploy.akamaitechnologies.com (AkamaiGHost/22.6.4-888a2d21768272d5e2d80e9762941e76) (-).
Akamai has documentation on how to interpret the X-Cache and X-Cache-Remote headers.
Maximum possible points
10
What is this check, and why should you care
An ETag is an opaque identifier for a specific version of a resource, defined in RFC 9110 §8.8.3. When a client revisits a URL it can send the previously-seen value back in an If-None-Match request header (RFC 9110 §13.1.2); if the server still considers the response current it returns an empty 304 Not Modified instead of the full body, saving bandwidth and origin work.
An ETag header is present but does not produce an HTTP 304 response. However a Last-Modified header is also present, which is sufficient for conditional requests. No penalty is applied.
Akamai has documentation on how to enable Etag support (requires login).
See the Wikipedia page on ETag for more background.
To get maximum points, you need to have ETag identifiers and an HTTP 304 response must be received when using a valid If-None-Match request header.
Maximum possible points
3
What is this check, and why should you care
The Last-Modified response header carries the date the resource was last changed, defined in RFC 9110 §8.8.2. When a client revisits the URL it can send the previously-seen value back in an If-Modified-Since request header (RFC 9110 §13.1.3); if the resource has not changed the server returns an empty 304 Not Modified instead of the full body, saving bandwidth and origin work.
An HTTP request with the request header If-Modified-Since with a value of Wed, 16 Sep 2026 14:39:31 GMT was sent, and an HTTP 304 was responded with.
Maximum possible points
3
What is this check, and why should you care
HTTP compression reduces the size of a response body by eliminating redundancy. The client advertises supported algorithms in the Accept-Encoding request header, and the server reports which one it used in the Content-Encoding response header — both are defined in RFC 9110 §8.4.
The four common encodings each have their own specification: gzip (RFC 1952), deflate (RFC 1951), br / Brotli (RFC 7932), and zstd / Zstandard (RFC 8878). Smaller responses load faster and use less bandwidth, which especially matters on mobile networks.
The response header Content-Encoding had a value of br.
Akamai has documentation on how to enable Brotli compression.
See the Wikipedia page on HTTP compression for more background.
To get maximum points, you need to use Brotli or Zstandard compression.
Maximum possible points
2
What is this check, and why should you care
A cached response is reusable for the duration of its freshness lifetime, defined in RFC 9111 §4.2. The freshness lifetime is taken from Cache-Control: s-maxage or max-age (§5.2), and falls back to the Expires header (§5.3) or a heuristic if neither is set. The longer the freshness lifetime, the higher the cache hit ratio at any given traffic level.
To get maximum points, your cache lifetime must be greater than or equal to 4 weeks. If your cache lifetime is less, then you will get some proportion of the score based on how close to 4 weeks you are.
The current cache lifetime is 1685179 seconds (2 weeks and 5 days).
Maximum possible points
10
HTTP Response headers
| Name | Value |
|---|---|
| Status Code | HTTP 200 |
| Alt-Svc | h3=":443"; ma=93600 |
| Cache-Control | max-age=0, no-cache, no-store |
| Connection | keep-alive |
| Content-Encoding | gzip |
| Content-Language | en |
| Content-Length | 29593 |
| Content-Type | text/html; charset=UTF-8 |
| Date | Mon, 12 Oct 2026 02:41:59 GMT |
| ETag | "1791676067" |
| Edge-Cache-Tag | 1bi12 2n0k5 53q2p 9b5uv 1g0qf 4oo3h 4eamq 3rjtc 4ppvl 6nf6k 58isp 7r5r3 79rb3 5f9hs 7tq81 37agv 7mt21 msb1r 7v603 7tv75 77ctv 6g6fg 5cbfi 5lkml 7tu48 6pp91 34pg5 s3iq7 72epf ouqa6 4pnm8 52s1r 7ke9n 6e5t7 4d1ta cb253 495dp 37dqa 7i7lt 1l5fa 58st6 2opk7 8pjnu 2md6q 4cs9s 5asui 6laqr 4o77p 6qqqa 1fkbv u93gp 39899 25idc 3lrv0 0npgc 111sf 3hqma 2vipc 37tbd 4hdkg 7tf2i 7ub96 73tvn 24l5r 26en1 3lib9 29q3v 31n0b 5i79e 0a95r 1a6cd 5s314 27cru 5abgd 3uvmm 52299 6qbq4 613hq 1e2gh 47l8t 2u39m 67pa5 37nbl 6ije9 303ev cui9e 3q8k2 6hubo 1fjmm 6gbhp 1j68u 7en58 1ap5r 69qd2 58l5u 5debd 20et5 1hg49 6chum 1tg6u 77vdk 77fvk 478r5 29iju 2lq5d 7pvor 1l8ld 2pfng 4dj26 4853p 2fqg7 1u2ql 1af48 5p7q6 1m0kg 3mt7l 3mo8c 1cuam |
| Expires | Mon, 12 Oct 2026 02:41:59 GMT |
| Last-Modified | Sat, 10 Oct 2026 23:47:47 GMT |
| Pragma | no-cache |
| Set-Cookie | ak_bmsc=9C65373F2F58122A5C13A97F01BA7A9E~000000000000000000000000000000~YAAQ2WcoFx0JZ9SgAQAArAX9LQG8tM2ENRxNXYar9cNUSmfciVs+kcY3sPi0qLXEWxIDLxpedOqeSxpKpc2IXeSkagVxqzYb7krtG3XNf85QVGZKTjkAPf7FxhUNgVfD/y9hlyyKhE+sUklJ2gWUFSdwSDK57naO/SVAan5mRMdAyRgc1R1HXq/FbQ7KQsNz+Hw3Io4XlFxlF9HjqIxsy2gGcT9G3iMSuqBGKOZjNOJB7capmcJerHdFkHqfwo4puny/Fo15q2/entO04N6ulGOJR/eSca/+A8CAYpEgYHJf66rPM3WiMPBhQSgBt3o7ic6KwJgAveaporOcXcUXhgkc3DSHbPAJfArunumYGXofQzIBHgzs/LQfFYkNSsLomVipY3FNf3CAdw==; Domain=.arpansa.gov.au; Path=/; Expires=Mon, 12 Oct 2026 04:41:59 GMT; Max-Age=7200; SameSite=None; Secure; HttpOnly, bm_mi=A2A87BDC6C03722B62E2935062D86782~YAAQ2WcoFx4JZ9SgAQAArAX9LQGNElDlt2xyPCoPS1qDWwCFX4xwGsTP2TzOz7IIPI4GyCpKpnhKDFv1JxeettQM2xxtrhtZO0ulIalCwIfUvZK9J9JXt8OubY3kE7aCSJP6kSm+uZwNE25o1k5pwobqxlhb9IiaDibCZgU9Q19MSEKR0lAJPNvx3dAiZGPHL6wT/z+62qWFlItBIsfjoZkX1LS15Hc+EFsqHBPE68r4h2kn+Bf1EEKmnhOOZ26NshA4wfkSOLo52+2L+EYamobCeqvlIWyRDUKbRtcB4xjn7hsXcqVN76mTLIwNxOHt0TVipzl8OOY0~1; Domain=.arpansa.gov.au; Path=/; Expires=Mon, 12 Oct 2026 02:41:59 GMT; Max-Age=0; SameSite=None; Secure |
| Vary | Accept-Encoding |
| X-Akamai-Transformed | 0 - 0 - |
| X-Cache | TCP_MEM_HIT from a23-40-103-217.deploy.akamaitechnologies.com (AkamaiGHost/22.6.4-888a2d21768272d5e2d80e9762941e76) (-) |
| X-Cache-Key | S/L/97003/563009/1d/www.arpansa.gov.au/?akamai-transform=9 |
| X-Cache-Key-Extended-Internal-Use-Only | S/L/97003/563009/1d/www.arpansa.gov.au/?akamai-transform=9 vcd=6147 |
| X-Check-Cacheable | YES |
| x-drupal-cache | HIT |
| x-drupal-dynamic-cache | MISS |
| x-lagoon | amazeeio-govcms5>sigsci-ingress-nginx>arpansa2-master:nginx> |
If you want to do this yourself
You can use the following cURL command:
curl -sLIXGET -H 'Pragma: akamai-x-cache-on, akamai-x-cache-remote-on, akamai-x-check-cacheable, akamai-x-get-cache-key, akamai-x-get-cache-tags' -H 'Accept-Encoding: br, zstd, gzip, deflate' 'https://www.arpansa.gov.au/' | sort