diff --git a/internal/api/root_handler_test.go b/internal/api/root_handler_test.go
index 0fded73..b1c09fe 100644
--- a/internal/api/root_handler_test.go
+++ b/internal/api/root_handler_test.go
@@ -18,6 +18,9 @@ func TestRootAndAPIDoc(t *testing.T) {
 	if r.Code != 200 || !strings.Contains(r.Body.String(), "<title>My Files</title>") || !strings.Contains(r.Body.String(), "<strong>Hello</strong>") {
 		t.Fatalf("root: %d %s", r.Code, r.Body.String())
 	}
+	if got := r.Header().Get("Cache-Control"); got != "no-store" {
+		t.Fatalf("root cache-control=%q", got)
+	}
 	r = httptest.NewRecorder()
 	h.ServeHTTP(r, httptest.NewRequest(http.MethodGet, "/asset/api.html", nil))
 	if r.Code != 200 || !strings.Contains(r.Body.String(), "/chfs/files") {
diff --git a/internal/api/server.go b/internal/api/server.go
index 70036bc..7c71fa7 100644
--- a/internal/api/server.go
+++ b/internal/api/server.go
@@ -1133,6 +1133,7 @@ func (s *Server) fileHandler(w http.ResponseWriter, r *http.Request) {
 		http.NotFound(w, r)
 		return
 	}
+	w.Header().Set("Cache-Control", "no-store")
 	title := s.HTMLTitle
 	if title == "" {
 		title = "CuteHttpFileServer"