Glossary

Two-factor authentication (2FA) An extra login confirmation (e.g. a code from an app) alongside the password, it blocks entry even if the password leaks. Brute force attack Automatically guessing a password by trying thousands of combinations until one works. Backdoor A hidden entry an attacker leaves after a breach, so they can return to the site even after it has been "cleaned". Cache A mechanism that remembers a ready-made version of the page, so it is not built from scratch on every visit. CDN (content delivery network) A network of servers around the world that speeds up your site and offloads your hosting. SSL certificate / HTTPS Encryption of the connection between the browser and the site, the padlock in the address bar and "https". Core Web Vitals A set of Google metrics rating a site's real-world speed and stability, they affect ranking. Credential stuffing Logging in with stolen passwords from other breaches, which works when someone reuses the same password in many places. CSP (Content-Security-Policy) A header that defines which scripts and resources the browser may load, a strong defence against XSS. CSRF (request forgery) An attack that tricks a logged-in user into performing an unwanted action. CVE (vulnerability identifier) A global catalogue number for a specific security flaw, e.g. CVE-2026-12345. CVSS (vulnerability severity score) A 0-10 scale describing how dangerous a vulnerability is. 9-10 is critical. DDoS (denial-of-service attack) Flooding a site with huge traffic from many sources at once until it stops responding. Defacement A visible change to a site's look or content by an attacker, the digital equivalent of graffiti. DNS (Domain Name System) The internet's "address book" that turns a domain name into a server address. Domain Your site's address on the internet (e.g. yourcompany.com), which you rent for a set period. Hardening A set of steps that reduce the attack surface and the impact of a potential breach in advance. Hosting The server service where your site "lives" and which makes it available to visitors. HSTS A header that forces the browser to connect to the site over HTTPS only. HTTPS The secure, encrypted version of the HTTP protocol, a foundation of trust and a Google requirement. Backup A saved, restorable state of the site you can return to after a failure, a breach or a mistake. Malware (malicious software) Malicious code someone plants on a site to abuse it, for redirects, spam, data theft or attacks on visitors. Password manager An app that generates and securely stores unique, strong passwords for all your accounts. Phishing Impersonating a trusted company to trick people into handing over passwords, card details or other sensitive information. Ransomware An attack that locks or encrypts data and demands a ransom to unlock it. RCE (remote code execution) The most dangerous class of flaw, it lets an attacker run their own code on your server. SPF, DKIM, DMARC Three DNS records that confirm email from your domain is genuine, protecting against spam and impersonation. SQL injection An attack that injects commands into the database through a form or URL, to steal or change data. WAF (web application firewall) A filter that sits in front of the site and blocks malicious requests before they reach the server. Web shell A malicious file (usually PHP) that lets an attacker manage the server remotely through a browser. XSS (cross-site scripting) Injecting a malicious script that runs in the browser of anyone visiting the site. Zero-day (0-day flaw) A vulnerability being exploited before the vendor has released a fix.