Web technology glossary
What is DNS? How do a domain and hosting differ? What do API, SSR or Core Web Vitals mean? Here you’ll find web terms on two levels: easy to follow for getting started and technical for day-to-day practice.
From the browser to the backend
Filter by topic or search for a specific question. Related terms guide you through frontend, backend, HTTP, CMS, performance and security.
API · Application Programming Interface
A defined interface through which software systems exchange data or call functions.
A website sends text to an AI model and receives the answer back via its API.
APIs enable controlled integration into existing systems; costs, limits, availability and data transfer must be planned for.
Astro · Web framework for content-focused websites
Astro is a web framework that ships little browser JavaScript by default and is particularly suited to content-focused websites.
Astro renders components to HTML on the server or at build time and only activates framework components through explicit client directives.
A company website is generated entirely statically and only adds small local scripts for filters and navigation.
Backend · The server-side part of an application
The backend handles business logic, data access, permissions and interfaces outside the visible browser interface.
Backend processes validate requests, coordinate services and databases and generate HTML or structured API responses.
A contact backend checks inputs, limits abuse and stores an enquiry.
Brotli & gzip · HTTP compression
HTTP compression shrinks text files during transfer and thereby reduces load time and data volume.
Client and server negotiate a method via Accept-Encoding and Content-Encoding; image formats that are already compressed usually don’t benefit.
HTML, CSS, JavaScript and JSON can often be made considerably smaller.
Cache · Temporary storage
A cache stores content that has already been computed or loaded so that it is available again more quickly.
Caching can happen in the browser, CDN, web server, application process, object cache or database system and needs clear invalidation rules.
A CDN stores an image file close to the visitor and avoids repeated fetches from the origin server.
Cache-Control · HTTP caching directive
Cache-Control defines whether and for how long clients or intermediate servers may store an HTTP response.
Directives such as max-age, no-cache, no-store, public, private and must-revalidate control reuse and revalidation.
Fingerprinted CSS files can be stored for a long time, while HTML should usually be revalidated regularly.
Canonical URL · Preferred address of a piece of content
A canonical URL marks the preferred address of content when several URLs show similar or identical content.
The link element is a strong consolidation signal, but not a redirect and not a guarantee; internal links and the sitemap should match it.
Tracking parameters show the same content, while canonical points to the clean URL.
CDN · Content Delivery Network
A CDN distributes and stores content across several locations so that it can be delivered closer to visitors.
Edge servers answer cacheable requests, often terminate TLS and can add protective functions such as DDoS defence or a WAF.
Images and scripts of an Austrian website are loaded from regional edge locations for international visitors.
CMS · Content management system
A CMS lets you maintain website content through an admin interface.
A CMS models content, user permissions, media and publishing workflows and renders or delivers web output from them.
Editors change service pages without editing HTML files directly.
A CMS makes sense when content is maintained regularly by several people; it does, however, increase maintenance and security effort.
Content Security Policy · CSP
A CSP limits the sources from which a page may load scripts, styles, images and other resources.
The HTTP policy works with directives and source expressions; nonces or hashes can mark specifically permitted inline code.
script-src 'self' basically only allows scripts from the page’s own origin.
A carefully introduced CSP makes XSS harder, but can block legitimate features if misconfigured.
Cookie · HTTP value stored by the browser
A cookie is a small value that a website can set in the browser and have sent along with matching later requests.
Attributes such as Domain, Path, Expires, Secure, HttpOnly and SameSite limit lifetime and transmission.
A random session identifier connects several requests to a logged-in session.
Cookies can be technically necessary or require consent and transparent privacy information.
Core Web Vitals · Google’s user experience metrics
Core Web Vitals assess key aspects of a page’s real-world loading, interactivity and layout stability.
The metrics are taken from field data or lab measurements; causes often lie in resource prioritisation, JavaScript work or unstable layouts.
An image without fixed dimensions can shift content after loading and worsen CLS.
CORS · Cross-Origin Resource Sharing
CORS controls which other origins browsers may allow to access a server’s resources.
Servers set Access-Control-Allow-* headers; non-simple requests can trigger an OPTIONS preflight. CORS is not server-side authentication.
An API only allows browser access from the frontend’s production domain.
Crawler & AI Crawler · Automated retrieval of web pages
Software that retrieves web pages automatically; AI crawlers do so for AI search, training or other AI services.
A bot retrieves publicly accessible pages and processes headings, texts and links.
Technical accessibility, robots rules and clear page structures influence which content a system can process at all.
CSR · Client-Side Rendering
Client-side rendering generates essential parts of an interface with JavaScript in the browser.
The client loads code and data, manages the UI state and updates the display without full document navigation.
A complex internal dashboard loads data via an API after startup and renders tables in the browser.
CSS · Cascading Style Sheets
CSS determines the presentation, layout and responsive adaptation of HTML content.
Selectors address elements; the cascade, specificity and inheritance determine which declarations are applied as computed styles.
A media query changes the layout for smaller screens.
CSS Grid · CSS Grid Layout
CSS Grid is a two-dimensional layout model for rows and columns.
Explicit and implicit tracks, grid lines, areas and minmax and fr units enable flexible grids without table markup.
A glossary page shows filters and results in two columns and stacks them on mobile devices.
Database · Structured data store
A database stores data in a structured way and provides functions for reading, changing and securing it.
Relational systems organise data in tables and relationships; other models use documents, key-value pairs, graphs or vectors.
A shop stores customers, products, orders and status changes in a database.
DNS · Domain Name System
DNS translates domain names into technical targets so that browsers, email servers and other services find the right systems.
Resolvers query the hierarchical DNS infrastructure for records such as A, AAAA, CNAME, MX or TXT and cache answers according to their TTL.
An A record connects example.at with the IPv4 address of the web server.
Faulty DNS records can make the website and email unreachable at the same time.
DOM · Document Object Model
The DOM is the programmable tree representation of a loaded HTML or XML document.
Browsers create nodes for elements, text and other parts of the document; JavaScript can read properties and change the tree in a targeted way.
A filter sets the hidden attribute on glossary cards that don’t match.
Domain · Readable name of an internet address
A domain is a readable name such as jkconcepts.at under which a website or another internet service can be reached.
The Domain Name System resolves the name via DNS records into technical targets such as IP addresses or other host names.
The domain example.at can point to a web server and, via separate DNS records, to an email provider.
Domain, DNS and hosting are separate building blocks and can be managed with different providers.
ETag · Entity Tag
An ETag is an identifier for a specific version of an HTTP resource.
The client later sends the value as If-None-Match; if the resource is unchanged, the server can respond with 304 without a full body.
A browser validates a cached CSS file without downloading it again in full.
Event Loop · Event loop of a JavaScript runtime
The event loop coordinates when JavaScript tasks and asynchronous callbacks are executed.
Once the current call stack has finished, the runtime processes queues; microtasks such as promise reactions are handled before the next regular task.
A completed network request queues its callback for later processing without interrupting the current code.
Flexbox · CSS Flexible Box Layout
Flexbox is a CSS layout model for arranging elements along a main and a cross axis.
Flex containers distribute available space via properties such as flex-grow, flex-shrink, flex-basis, justify-content and align-items.
Navigation items are distributed in a row and may wrap when space is tight.
Frontend · The user-facing part of an application
The frontend is the part of a website or application that people see and operate.
On the web it covers HTML, CSS, JavaScript, browser APIs, state logic and communication with server-side interfaces.
Forms, navigation, glossary filters and visual design are all part of the frontend.
Full Stack · Development across frontend and backend
Full stack refers to work across several layers of a web application, in particular frontend, backend and data storage.
The term describes breadth, not automatically depth; infrastructure, security, operation and architecture can be part of it too.
A feature covers the form interface, API endpoint, validation and database storage.
Headless CMS · CMS without a tightly coupled website output
A headless CMS manages content and delivers it via APIs without dictating the final website interface.
Frontend and editing are decoupled; content can serve several channels, but needs a separate rendering, preview and deployment concept.
Product data is delivered to the website, an app and an internal display from the same content source.
HSTS · HTTP Strict Transport Security
HSTS instructs browsers to access a domain only via HTTPS for a defined period.
The Strict-Transport-Security header can include subdomains; preloading also reduces the risk on the very first visit.
A browser locally replaces a later http request with https.
HTML · HyperText Markup Language
HTML describes the content and semantic structure of a web document.
After parsing, elements and attributes form the DOM; semantic elements support browsers, search engines and assistive technologies.
Headings, navigation, paragraphs, forms and images are marked up with suitable HTML elements.
HTTP · Hypertext Transfer Protocol
HTTP is the protocol with which clients and servers exchange requests and responses for web resources.
A message consists of a method or status, headers and optionally a body. HTTP is stateless; session state is established separately.
A browser sends GET /contact/ and the server responds with status 200 and HTML.
HTTP 404 · Not Found
The status code 404 means that the server found no matching resource for the requested URL.
A genuine error page must still send HTTP status 404 alongside helpful content; an error page that only looks like one but returns status 200 is a soft 404.
A deleted path without a suitable replacement returns a branded 404 page.
HTTP 500 · Internal Server Error
The status code 500 reports an unexpected server-side error while processing a request.
The public response is deliberately generic; specific causes are found in application and server logs and can range from code errors to resource problems.
A faulty plugin triggers an unhandled PHP exception.
HTTP Header · Metadata of an HTTP message
HTTP headers carry additional information about a request or response.
Headers control, among other things, content type, caching, authentication, compression, cookies, CORS and browser security rules.
Content-Type: application/json marks a JSON response.
HttpOnly · Cookie protection against JavaScript access
HttpOnly prevents JavaScript in the browser from reading a cookie’s value directly.
The browser still sends the cookie automatically with matching HTTP requests; CSRF protection and XSS prevention therefore remain necessary.
The session ID is not visible to document.cookie.
HTTPS · HTTP over TLS
HTTPS uses TLS to protect the connection between client and server against simple eavesdropping and tampering.
After the TLS handshake, HTTP messages are transmitted encrypted and authenticated; the certificate binds the public key to a host name.
A login form does not transmit credentials as unencrypted plain text over the network.
HTTPS is a basic requirement for secure forms, modern browser features and trustworthy website operation.
Hydration · Activating server-rendered HTML
Hydration connects HTML that has already been rendered in the browser with JavaScript state and interactions.
The client framework reconstructs the component tree and binds events; differences between server and client output can cause hydration errors.
A menu that is visible from the server becomes interactive once the JavaScript has loaded.
Islands Architecture · Island architecture for interactive components
With islands architecture, most of a page stays static while only selected components get JavaScript.
Interactive islands are hydrated or loaded independently, so the entire page doesn’t have to run as a client application.
A static content page activates only search, navigation and a form as interactive parts.
JavaScript · The programming language of the web
JavaScript is a programming language for interactive browser features and many server-side applications.
Browsers run ECMAScript in a runtime with web APIs, an event loop and DOM access; modules structure larger applications.
A glossary search shows matching terms as you type.
JSON · JavaScript Object Notation
JSON is a text-based data format for structured values such as objects, lists, strings, numbers and booleans.
JSON has a clearly defined syntax, but no comments, functions or dates as a type of their own.
An API responds with {"status":"ok","count":3}.
Lazy Loading · Deferred loading
Lazy loading only loads content or code when it is likely to be needed.
Browsers can lazy-load images and iframes natively; bundlers split JavaScript into separately fetchable chunks via dynamic imports.
Images far below the visible area are not transferred on the first page view.
Logging · Recording events
Logging records technical and security-relevant events for diagnosis, traceability and detection.
Good logs contain the time, event type and necessary context, avoid sensitive content and are protected against unnoticed tampering.
Failed logins are logged with the account, time and approximate origin.
Media Query · Conditional CSS rule for output properties
A media query activates CSS rules depending on properties such as the available width or user preferences.
Besides viewport features, prefers-reduced-motion, colour scheme, pointer precision and print media can be queried, among others.
From 64rem upwards, a filter bar is shown as a sidebar next to the results.
Mobile First · Design approach starting from the small screen
Mobile first starts with a clear, complete mobile presentation and extends it for larger screens.
Base rules apply to small viewports; min-width media queries add layout and features progressively.
The glossary cards start as a single column and become two columns on wide screens.
Monitoring · Ongoing system monitoring
Monitoring observes the availability, performance, errors and selected security signals of a system.
Metrics, synthetic checks and log signals need thresholds, alerting paths and responsible responses so that data turns into action.
An alert is triggered when the website cannot be reached or errors rise sharply.
MySQL · Relational database system
MySQL is a relational database system that stores data in tables and queries it with SQL.
Schemas, keys, indexes, transactions and constraints structure and protect data; MariaDB is a related but independent system.
WordPress typically stores posts, options, users and metadata in MySQL or MariaDB.
Node.js · JavaScript runtime outside the browser
Node.js runs JavaScript outside the browser and is used for servers, tools and build processes.
The runtime combines the V8 engine with event-driven I/O interfaces and a package ecosystem built around npm.
Astro uses Node.js to generate the static website.
PHP · Server-side programming language
PHP is a server-side programming language used particularly often for websites, APIs and content management systems.
A PHP process handles a request, runs application code and generates an HTTP response; Composer manages typical package dependencies.
WordPress and WooCommerce run most of their core logic in PHP.
301 Redirect · Permanent HTTP redirect
A 301 redirect marks a permanent redirect to a new URL.
Clients and search engines may adopt the target in the long term; for unsafe methods, 308 can express preservation of the method more clearly.
An old WordPress address is redirected after the relaunch to the new route with the corresponding content.
Rate Limiting · Limiting requests
Rate limiting restricts how many actions are allowed within a period of time.
Limits can apply per account, token, IP, route or risk signal; distributed systems need a shared or consistent counter.
After several failed logins, further attempts are delayed step by step.
React · JavaScript library for user interfaces
React is a component-based JavaScript library for building state-driven user interfaces.
Components produce declarative element trees; React coordinates state changes, rendering and, depending on the runtime, server- or client-side execution.
A complex dashboard breaks navigation, filters, tables and charts down into reusable components.
Redirect · HTTP redirect
A redirect tells the client that a resource is available at a different URL.
3xx status codes distinguish, among other things, permanent and temporary targets and how the original HTTP method is handled.
After a relaunch, the old service URL leads permanently to the matching new page.
Request & Response · Request and response
A client sends a request; the server processes it and returns a response.
Requests contain a method, target, headers and optional data. Responses contain a status code, headers and an optional response body.
POST /api/contact submits form data and receives a success or error message.
Responsive Web Design · Adaptive web layout
Responsive web design adapts content, layout and interaction to different screen sizes and input methods.
Flexible grids, intrinsic sizing, responsive media and media and container queries avoid separate device-specific layouts.
On small screens, filter chips can be scrolled horizontally instead of taking up many rows.
REST API · HTTP interface following REST principles
A REST API provides resources and actions via clearly defined HTTP endpoints.
Typical interfaces use HTTP methods, status codes, URLs and representation-based data formats; REST itself does not require JSON.
GET /api/orders/42 reads an order, PATCH updates selected fields.
robots.txt · Crawler control file
robots.txt gives cooperating crawlers rules for fetching certain areas of a website.
The file lives at the origin under /robots.txt; Disallow does not prevent access and is no reliable protection against indexing or attackers.
Internal search results are excluded from crawling by search engine bots.
SameSite Cookie · Limiting cross-site cookie transmission
SameSite controls when a browser sends cookies with requests from a different site context.
Strict, Lax and None have different rules for navigation and embedding; SameSite=None requires Secure.
A Lax session cookie reduces many simple CSRF scenarios without preventing normal link navigation.
Schema.org · Vocabulary for structured web data
A shared vocabulary that websites use to describe people, organisations, offers, terms and other content.
A glossary uses DefinedTermSet and DefinedTerm to mark up terms and definitions in a machine-readable way.
Schema.org creates a common language for systems; markup alone does not replace helpful visible content, however.
Secure Cookie · Cookie sent only over HTTPS
The Secure attribute ensures that a cookie is only sent over encrypted HTTPS connections.
It doesn’t protect against client-side reading and should be combined for sensitive cookies with HttpOnly, SameSite and narrow domain and path limits.
A session cookie is never transmitted over an unencrypted HTTP connection.
Security Headers · HTTP security headers
Security headers give the browser additional security rules for a website.
CSP, HSTS, frame-ancestors, Referrer-Policy and other headers limit loading sources, protocol downgrades, embedding and the sharing of information.
A CSP prevents arbitrary third-party scripts from being executed on a page.
Session · Server-side session state
A session keeps related user requests in a shared state across several page views.
Usually the server stores the state and the browser only sends a random session ID in a protected cookie.
After login, the server recognises the logged-in user from the session ID.
SPA · Single Page Application
An SPA loads one application document and then updates views mainly in the browser.
Client-side routing and state management replace many full page navigations; data usually comes via APIs.
A project management tool switches between tasks and views without reloading the whole document.
SSG · Static Site Generation
With static site generation, finished HTML pages are created before publication instead of on every request.
A build reads templates and data, produces files and can deliver them via simple web space or a CDN.
Astro generates all known pages as static HTML files during the build.
SSR · Server-Side Rendering
Server-side rendering generates HTML on the server, typically for each request or via a server-side cache.
The server runs application logic and serialises the view; client-side hydration can then add interactivity.
A personalised portal renders a user-specific overview page after login.
Structured Data · Machine-readable page data
Machine-readable information that describes the content and meaning of a page in defined fields.
A website additionally marks up its organisation, services or defined terms as JSON-LD.
Structured data makes unambiguous interpretation easier, but must match the visible content and be technically correct.
Subresource Integrity · SRI
SRI lets browsers check whether an externally loaded resource matches the expected cryptographic hash exactly.
The integrity attribute contains one or more hash values; for cross-origin resources, the CORS configuration must allow the check.
A CDN script is only executed if its content matches the stored SHA-384 hash.
TLS · Transport Layer Security
TLS is a protocol for encrypted network connections that are protected against tampering.
The handshake negotiates the version and cryptographic methods, checks certificates and derives session keys for symmetric encryption.
HTTPS, secure mail transfer and many APIs use TLS to protect the transport.
TLS Certificate · Digital certificate for a host name
A TLS certificate confirms that a public key belongs to a domain name.
Browsers check the signature, validity, host name and the certificate chain up to a trusted certificate authority.
Let’s Encrypt provides automatable domain certificates for HTTPS.
TypeScript · JavaScript with static type checking
TypeScript extends JavaScript with static types and additional development tools.
The compiler checks type relationships before execution and produces JavaScript; the type information itself is normally not available at runtime.
An interface describes which fields a glossary term must have.
URL · Uniform Resource Locator
A URL describes the address of a specific resource on the web.
It can contain scheme, host, port, path, query string and fragment, for example https://example.at/search/?q=test#results.
The domain names the host; the path /contact/ denotes a resource on that host.
Web Accessibility · Accessible websites for everyone
Web accessibility ensures that people with different abilities and assistive tools can use digital content.
Semantic HTML, keyboard operation, focus management, contrast, clear labels and robust interfaces to assistive technologies are central foundations.
A search field has a visible label, and filter buttons expose their pressed state programmatically.
Web App · Web application
A web app is an application operated in the browser in which users edit data or carry out specific workflows.
Web apps combine a user interface in the browser with server-side logic, APIs, databases and often a user login.
An internal order portal replaces shared Excel files and coordination by email.
The distinction from a website affects architecture, security needs, development costs and ongoing support.
Web Hosting · Operating environment for websites
Web hosting provides storage, computing power and network access so that a website can be delivered on the internet.
Depending on the plan, web server, runtime, database, TLS, backups and email run on shared, virtual, dedicated or managed infrastructure.
WordPress hosting runs PHP, connects to MySQL and delivers images and stylesheets.
The performance, security, backups and support of the hosting affect how reliable the website is.
Web Server · Server for HTTP requests
A web server accepts HTTP requests and delivers files or dynamically generated responses to browsers and other clients.
Software such as nginx or Apache handles TLS, routing, caching, compression and forwarding to application processes.
The web server delivers a static HTML file directly or forwards a PHP request to PHP-FPM.
WebAuthn · Web Authentication API
WebAuthn is the browser API for strong public-key logins with passkeys and security keys.
The server sends a challenge; the authenticator signs it for the specific relying party, preventing simple phishing reuse.
A hardware security key confirms the administrator login.
Webhook · Event-driven HTTP call
A webhook automatically informs another system about an event via HTTP.
The sender calls a registered URL; receivers should check signatures, tolerate retries and make processing idempotent.
A payment provider tells the shop that a payment has been completed successfully.
Website · A connected web presence
A website is a web presence reachable via a domain, made up of one or more related pages.
Browsers load documents and resources from a web server via HTTP or HTTPS. Navigation, URLs and links connect the individual pages into a shared offering.
A company website contains, for example, a homepage, services, projects, contact and legal pages.
For structure, operation and cost, what matters is whether a simple website, a CMS, a shop or a web app is needed.
WebSocket · Persistent bidirectional web connection
WebSocket enables a permanently open connection over which client and server can send messages at any time.
After an HTTP upgrade, the connection uses its own frame-based protocol over TCP and needs explicit authentication and connection logic.
Chats, live dashboards or collaborative editing transmit updates without constant polling.
WordPress · Open-source content management system
WordPress is a widely used open-source CMS for websites, editorial content and, with extensions, online shops.
WordPress is based mainly on PHP and MySQL, has theme, plugin, hook, role and REST API systems and needs ongoing updates.
A custom theme reflects the corporate design, while structured content fields make maintenance easier.
Quality depends heavily on architecture, extensions, maintenance, hosting and security configuration.
WP-Cron · Event scheduling in WordPress
WP-Cron runs scheduled WordPress tasks, but by default is triggered by page views.
With irregular or high traffic, a real system cron can be more reliable; blocked or overloaded cron runs affect updates and background jobs.
Scheduled publications and WooCommerce background tasks depend on cron events running reliably.
XML Sitemap · Machine-readable list of URLs
An XML sitemap lists indexable URLs and optional update dates for search engines.
It helps with discovery, but replaces neither internal linking nor indexability and doesn’t guarantee inclusion in the search index.
A static build generates a sitemap from all indexable routes.
Try a more general search term or reset the filters.
Technology that fits the project
The right architecture depends on content, workflows, interfaces, maintenance and the actual goal.
Discuss a project