i was under the impression that ISA should NOT cache any https pages... for 90% of https sites this is true but the UK HSBC EBank site seems to get cached somewhere. When the site loads, pages with "this page has expired, please refresh your browser" message come up and then it logs you out of the site. I have been able to get the site to work correctly using a secureNAT client and bypassing the proxy service, but this is not the ideal solution as the site should be accessed through the proxy (like the rest) As work arounds, I have tried creating a destination set: *.ebank.hsbc.co.uk/* *.hsbc.co.uk/* and using a routing rule to stop it from being cached (a method i use for access to our development web servers, so i know the way i have done that is correct) I have also tried to exclude the domain from the local proxy exclusion list, but that has not worked either. I have also deleted the cache, which works for one visit, but then the cached pages are there on the next visit. any thoughts? Thanks, Charlie.