Clear-Site-Data header: example values and what Chrome actually cleared (tested)

Clear-Site-Data tells the browser to delete the site's cookies, storage or cache. The syntax is strict, and in our test not every value did everything people expect.

1. What was left afterwards

Clear-Site-Data	Cookie	localStorage	Cached script
`"cookies"`	Deleted	Kept	Kept
`"storage"`	Kept	Deleted	Kept
`"cache"`	Kept	Kept	Kept
`"*"`	Deleted	Deleted	Kept
`cookies` (no quotes)	Kept	Kept	Kept: ignored

2. Why it's "not working"

Quotes are required. Clear-Site-Data: cookies did nothing; "cookies" worked. Several values: "cookies", "storage".
"cache" didn't evict our cached script. After "cache" and "*", the next page still took the script from cache without a request. Don't rely on it to force fresh files: change file URLs instead (how Chrome caches, measured).
It only works on secure origins (HTTPS, or localhost/127.0.0.1 while developing) and only for the origin that sends it.

3. Logout example

# nginx: on the logout endpoint only, never site-wide
location = /logout {
    add_header Clear-Site-Data '"cookies", "storage"' always;
    proxy_pass http://app;
}

Still expire the session on the server: the header cleans the browser, it doesn't revoke a stolen token. Pair it with HttpOnly session cookies.

Frequently asked questions

Why is Clear-Site-Data not working?

Most often missing quotes: in our Chrome test Clear-Site-Data: cookies was ignored and "cookies" worked. It also needs HTTPS (or localhost).

Does Clear-Site-Data cache clear the browser cache?

Not reliably: in our Chrome 153 test a script cached with max-age=600 was still served from cache after "cache" and "*".

What does Clear-Site-Data * clear?

In our test it deleted cookies and localStorage; the cached script stayed.

Where should I send Clear-Site-Data?

Only on the logout response. Sending it on every page would log users out constantly.

Written with AI assistance. Measured on 2026-10-01 in Chromium 153 (full build), fresh profile per row: a page on http://127.0.0.1:8999 (a secure context) set a cookie, a localStorage value and loaded a script with Cache-Control: max-age=600; then a /clear response sent each Clear-Site-Data value and we checked what was left. The logout example and HTTPS requirement are from the spec, not this test. PlainHeaders is our extension; the other methods are free.