An account page contains personal details. Establish which caches may store its HTTP response. private excludes shared caches but alone still permits storage in a private browser cache. no-store instead instructs caches not to store the response.
One possible header for an appropriately configured personal area is:
Cache-Control: private, no-store
Choose the policy for the application and delivery route. It does not replace authentication or server-side authorisation. A new header also does not retrospectively remove every existing copy.
Use artificial account data
Inspect isolated test accounts containing invented details, and check account HTML separately from associated data responses. Correct HTML headers do not compensate for an API publicly caching personal results.
Inspect headers after the proxy or CDN rather than only in local development. Check logout and switching between two test accounts as well. Browser navigation behaviour and actual server authorisation require separate observations.
If another identity’s data appears, stop using the affected route and investigate with test data. Inspect cache keys and server-side authorisation in that case. Record tested endpoints, synthetic identities without credentials and the responses actually observed so the correction remains traceable.