empiricompany/maho-nocacheheader

Adds Cache-Control: no-store, no-cache, must-revalidate and Pragma: no-cache headers globally on all frontend pages, restoring OpenMage default behavior. Configurable via admin.

0.1.0 2026-06-06 11:19 UTC

Requires

• php: >=8.3

Requires (Dev)

• friendsofphp/php-cs-fixer: *
• mahocommerce/maho: *
• mahocommerce/maho-phpstan-plugin: *
• phpstan/phpstan: *
• phpstan/phpstan-deprecation-rules: *
• phpstan/phpstan-strict-rules: *
• rector/rector: *

OSL-3.0

README

A Maho module that sends Cache-Control: no-store, no-cache, must-revalidate and Pragma: no-cache headers on all frontend pages. Configurable via admin.

When to use this module

Maho supports the browser's back-forward cache (bfcache) natively via the pageshow JavaScript event (see PR #991). This is the recommended approach: pages are served from bfcache for instant navigation, and the pageshow handler refreshes dynamic content (cart sidebar, checkout state) when the page is restored.

This module is intended for custom or legacy themes that do not implement the pageshow event (or equivalent client-side logic) and need to prevent stale dynamic content by disabling bfcache on the server side via Cache-Control: no-store.

Requirements

• PHP >= 8.3
• Maho Commerce

Installation

composer require empiricompany/maho-nocacheheader

Clear the cache after installation:

./maho cache:flush

Configuration

Go to System → Configuration → Web → Cache-Control Header and set Add Cache-Control: no-store, no-cache, must-revalidate and Pragma: no-cache headers to Yes.

The setting applies to frontend only — admin panel is not affected.

Development

This module ships with the standard Maho CI gates:

• PHPStan (level 8) — vendor/bin/phpstan analyze
• Rector (dry-run) — vendor/bin/rector -c .rector.php --dry-run
• PHP CS Fixer (dry-run) — vendor/bin/php-cs-fixer fix --dry-run
• PHP / XML syntax checks — automatic on CI

Run composer install and you can execute any of the above locally before pushing.

License

OSL-3.0 / AFL-3.0