Every cache stores objects under keys, and Vary is the header that widens the key. Used precisely, it serves the right variant to the right client. Used carelessly, it shatters one hot object into thousands of cold ones, and your hit ratio quietly bleeds out through a header nobody remembers adding.
The mechanics of a cache key
The baseline key is scheme, host and path, usually plus the query string. Vary appends request-header values to that key: Vary: Accept-Encoding stores separate compressed and uncompressed copies, which is necessary and harmless because the header has a handful of values. Vary: User-Agent multiplies the key by the practically infinite space of UA strings, guaranteeing near-zero reuse. The rule is arithmetic: your effective object count is objects times the cardinality of every varied header, and cardinality is the number to interrogate.
Query strings, the other fragmenter
Marketing parameters, click IDs and tracking suffixes create unique URLs for identical content, and default configurations key on all of them. The fix is explicit: normalize the cache key to ignore parameters that do not change the response, or allowlist the ones that do. This single change is the largest hit-ratio win in a substantial share of the audits we run, and it takes an afternoon.
A war story with numbers, anonymized from an audit: a retailer’s product pages ran Vary: User-Agent, inherited from a device-detection experiment two platform generations earlier. Effective hit ratio on their most expensive pages: eleven percent. Replacing it with edge-side device bucketing into two classes, varied on one computed header, took the ratio past ninety within a day and cut origin compute by a third. The experiment that added the header had been retired for years; the fragmentation it left ran a meter the whole time. Headers outlive intentions, which is why the quarterly inspection exists.
Doing variation properly
When responses genuinely differ per client, do the variation deliberately: normalize inputs at the edge (bucket Accept-Language to your supported locales, collapse device detection to two or three classes) and vary on the normalized value, not the raw header. Modern CDN key controls let you construct keys from cookies, headers or computed values, which converts Vary from a blunt multiplication into a designed dimension with known cardinality.
In practice
Quarterly, pull your top hundred URLs by request count and inspect their keys: what varies them, what query parameters they carry, and what the resulting variant counts are. Multiply out the fragmentation, fix the three worst offenders, and re-measure hit ratio. This ritual takes an hour and compounds, because key hygiene, unlike most performance work, stays fixed until someone adds the next header.
Cache-key design reviews are a standing part of our performance engagements. One afternoon, measured before and after.