diff --git a/settings/siteaccess/base/site.ini.append b/settings/siteaccess/base/site.ini.append
index c0fabd195f9..f62a1c29b20 100644
--- a/settings/siteaccess/base/site.ini.append
+++ b/settings/siteaccess/base/site.ini.append
@@ -7,3 +7,10 @@ RequireUserLogin=false
 [DesignSettings]
 StandardDesign=standard
 SiteDesign=base
+
+[HTTPHeaderSettings]
+# Legacy responses are getting Cache-Control:private by default.
+# Force them to be public so Varnish / reverse proxies can cache
+CustomHeader=enabled
+OnlyForContent=disabled
+Cache-Control[/]=public
diff --git a/settings/siteaccess/mysite/site.ini.append b/settings/siteaccess/mysite/site.ini.append
index 052a4c9e4cf..242476d6155 100644
--- a/settings/siteaccess/mysite/site.ini.append
+++ b/settings/siteaccess/mysite/site.ini.append
@@ -23,3 +23,10 @@ SiteDesign=mysite
 # if the design was not found in the main 
 # sitedesign. StandardDesign is the fallback design.
 AdditionalSiteDesignList[]=
+
+[HTTPHeaderSettings]
+# Legacy responses are getting Cache-Control:private by default.
+# Force them to be public so Varnish / reverse proxies can cache
+CustomHeader=enabled
+OnlyForContent=disabled
+Cache-Control[/]=public
diff --git a/settings/siteaccess/plain/site.ini.append b/settings/siteaccess/plain/site.ini.append
index 3367775cdf1..2fa5b980147 100644
--- a/settings/siteaccess/plain/site.ini.append
+++ b/settings/siteaccess/plain/site.ini.append
@@ -15,3 +15,10 @@ RequireUserLogin=false
 
 [DesignSettings]
 SiteDesign=plain
+
+[HTTPHeaderSettings]
+# Legacy responses are getting Cache-Control:private by default.
+# Force them to be public so Varnish / reverse proxies can cache
+CustomHeader=enabled
+OnlyForContent=disabled
+Cache-Control[/]=public