{
  "url": "https://www.jkconcepts.at/en/website-security-glossary/",
  "canonical": "https://www.jkconcepts.at/en/website-security-glossary/",
  "robots": "noindex, follow",
  "language": "en-GB",
  "content": [
    {
      "type": "paragraph",
      "text": "Website security glossary"
    },
    {
      "type": "heading",
      "level": 1,
      "text": "Website security: cybersecurity terms explained"
    },
    {
      "type": "paragraph",
      "text": "What are XSS, SQL injection or a WAF? How do MFA, security headers and backups protect a website? This glossary explains risks and countermeasures clearly and with technical precision."
    },
    {
      "type": "paragraph",
      "text": "Browse the terms All knowledge areas",
      "links": [
        {
          "text": "Browse the terms",
          "url": "https://www.jkconcepts.at/en/website-security-glossary/#glossar"
        },
        {
          "text": "All knowledge areas",
          "url": "https://www.jkconcepts.at/en/knowledge/"
        }
      ]
    },
    {
      "type": "paragraph",
      "text": "At a glance"
    },
    {
      "type": "heading",
      "level": 3,
      "text": "Scope"
    },
    {
      "type": "paragraph",
      "text": "82 terms"
    },
    {
      "type": "heading",
      "level": 3,
      "text": "Reading levels"
    },
    {
      "type": "paragraph",
      "text": "Simple and technical"
    },
    {
      "type": "heading",
      "level": 3,
      "text": "Last updated"
    },
    {
      "type": "paragraph",
      "text": "October 2026"
    },
    {
      "type": "paragraph",
      "text": "Understand attacks, put protection in context"
    },
    {
      "type": "heading",
      "level": 2,
      "text": "Website security from A to Z"
    },
    {
      "type": "paragraph",
      "text": "The terms focus on websites, web applications, WordPress and secure operations – with cross-references between attacks, causes and safeguards."
    },
    {
      "type": "paragraph",
      "text": "Search for a term or question"
    },
    {
      "type": "paragraph",
      "text": "Topic"
    },
    {
      "type": "paragraph",
      "text": "82 terms shown"
    },
    {
      "type": "paragraph",
      "text": "Recognise risks"
    },
    {
      "type": "heading",
      "level": 2,
      "text": "Common attacks & vulnerabilities"
    },
    {
      "type": "paragraph",
      "text": "Starting points for acute problems, typical web attacks and published security vulnerabilities."
    },
    {
      "type": "paragraph",
      "text": "Vulnerability Malware Phishing Brute Force Credential Stuffing SQL Injection Cross-Site Scripting CSRF SSRF Remote Code Execution Backdoor CVE",
      "links": [
        {
          "text": "Vulnerability",
          "url": "https://www.jkconcepts.at/en/website-security-glossary/#vulnerability"
        },
        {
          "text": "Malware",
          "url": "https://www.jkconcepts.at/en/website-security-glossary/#malware"
        },
        {
          "text": "Phishing",
          "url": "https://www.jkconcepts.at/en/website-security-glossary/#phishing"
        },
        {
          "text": "Brute Force",
          "url": "https://www.jkconcepts.at/en/website-security-glossary/#brute-force"
        },
        {
          "text": "Credential Stuffing",
          "url": "https://www.jkconcepts.at/en/website-security-glossary/#credential-stuffing"
        },
        {
          "text": "SQL Injection",
          "url": "https://www.jkconcepts.at/en/website-security-glossary/#sql-injection"
        },
        {
          "text": "Cross-Site Scripting",
          "url": "https://www.jkconcepts.at/en/website-security-glossary/#xss"
        },
        {
          "text": "CSRF",
          "url": "https://www.jkconcepts.at/en/website-security-glossary/#csrf"
        },
        {
          "text": "SSRF",
          "url": "https://www.jkconcepts.at/en/website-security-glossary/#ssrf"
        },
        {
          "text": "Remote Code Execution",
          "url": "https://www.jkconcepts.at/en/website-security-glossary/#rce"
        },
        {
          "text": "Backdoor",
          "url": "https://www.jkconcepts.at/en/website-security-glossary/#backdoor"
        },
        {
          "text": "CVE",
          "url": "https://www.jkconcepts.at/en/website-security-glossary/#cve"
        }
      ]
    },
    {
      "type": "paragraph",
      "text": "Build protection"
    },
    {
      "type": "heading",
      "level": 3,
      "text": "Controls & secure operations"
    },
    {
      "type": "paragraph",
      "text": "Technical and organisational layers of protection for applications, accounts and recovery."
    },
    {
      "type": "paragraph",
      "text": "Web Application Firewall MFA / 2FA Least Privilege Security Headers Content Security Policy HSTS Rate Limiting Backup Monitoring WordPress Hardening File Integrity Monitoring",
      "links": [
        {
          "text": "Web Application Firewall",
          "url": "https://www.jkconcepts.at/en/website-security-glossary/#waf"
        },
        {
          "text": "MFA / 2FA",
          "url": "https://www.jkconcepts.at/en/website-security-glossary/#mfa"
        },
        {
          "text": "Least Privilege",
          "url": "https://www.jkconcepts.at/en/website-security-glossary/#least-privilege"
        },
        {
          "text": "Security Headers",
          "url": "https://www.jkconcepts.at/en/website-security-glossary/#security-headers"
        },
        {
          "text": "Content Security Policy",
          "url": "https://www.jkconcepts.at/en/website-security-glossary/#csp"
        },
        {
          "text": "HSTS",
          "url": "https://www.jkconcepts.at/en/website-security-glossary/#hsts"
        },
        {
          "text": "Rate Limiting",
          "url": "https://www.jkconcepts.at/en/website-security-glossary/#rate-limiting"
        },
        {
          "text": "Backup",
          "url": "https://www.jkconcepts.at/en/website-security-glossary/#backup"
        },
        {
          "text": "Monitoring",
          "url": "https://www.jkconcepts.at/en/website-security-glossary/#monitoring"
        },
        {
          "text": "WordPress Hardening",
          "url": "https://www.jkconcepts.at/en/website-security-glossary/#wordpress-hardening"
        },
        {
          "text": "File Integrity Monitoring",
          "url": "https://www.jkconcepts.at/en/website-security-glossary/#file-integrity-monitoring"
        }
      ]
    },
    {
      "type": "heading",
      "level": 2,
      "text": "Terms starting with A"
    },
    {
      "type": "paragraph",
      "text": "AI security · Advanced #ai-guardrails",
      "links": [
        {
          "text": "#ai-guardrails",
          "url": "https://www.jkconcepts.at/en/website-security-glossary/#ai-guardrails"
        }
      ]
    },
    {
      "type": "heading",
      "level": 3,
      "text": "What does AI Guardrails mean?"
    },
    {
      "type": "paragraph",
      "text": "AI Guardrails · Technical and organisational guardrails"
    },
    {
      "type": "paragraph",
      "text": "Rules, checks and limits around the inputs, outputs and actions of an AI system."
    },
    {
      "type": "heading",
      "level": 3,
      "text": "Technology, example and context"
    },
    {
      "type": "heading",
      "level": 4,
      "text": "Example"
    },
    {
      "type": "paragraph",
      "text": "An application blocks sensitive data, validates outputs and requires approval before external actions."
    },
    {
      "type": "heading",
      "level": 4,
      "text": "Why does it matter?"
    },
    {
      "type": "paragraph",
      "text": "Guardrails reduce certain risks, but must be implemented in several layers and tested regularly against real failure cases."
    },
    {
      "type": "heading",
      "level": 4,
      "text": "Related terms"
    },
    {
      "type": "paragraph",
      "text": "Human in the Loop Prompt Injection Evaluation, Evals & Benchmarks",
      "links": [
        {
          "text": "Human in the Loop",
          "url": "https://www.jkconcepts.at/en/ai-glossary/#human-in-the-loop"
        },
        {
          "text": "Prompt Injection",
          "url": "https://www.jkconcepts.at/en/website-security-glossary/#prompt-injection"
        },
        {
          "text": "Evaluation, Evals & Benchmarks",
          "url": "https://www.jkconcepts.at/en/ai-glossary/#evaluation-evals"
        }
      ]
    },
    {
      "type": "paragraph",
      "text": "Identity & access · Basic #authentication",
      "links": [
        {
          "text": "#authentication",
          "url": "https://www.jkconcepts.at/en/website-security-glossary/#authentication"
        }
      ]
    },
    {
      "type": "heading",
      "level": 3,
      "text": "What is authentication?"
    },
    {
      "type": "paragraph",
      "text": "Authentication · Verifying an identity"
    },
    {
      "type": "paragraph",
      "text": "Authentication checks who a user or system is."
    },
    {
      "type": "heading",
      "level": 3,
      "text": "Technology, example and context"
    },
    {
      "type": "heading",
      "level": 4,
      "text": "Technical explanation"
    },
    {
      "type": "paragraph",
      "text": "After a successful check, a system usually issues a session or token; secure methods also cover recovery and logout."
    },
    {
      "type": "heading",
      "level": 4,
      "text": "Example"
    },
    {
      "type": "paragraph",
      "text": "A user proves their identity with a passkey or with a password plus TOTP."
    },
    {
      "type": "heading",
      "level": 4,
      "text": "Related terms"
    },
    {
      "type": "paragraph",
      "text": "Authorisation MFA / 2FA Session Passkey",
      "links": [
        {
          "text": "Authorisation",
          "url": "https://www.jkconcepts.at/en/website-security-glossary/#authorization"
        },
        {
          "text": "MFA / 2FA",
          "url": "https://www.jkconcepts.at/en/website-security-glossary/#mfa"
        },
        {
          "text": "Session",
          "url": "https://www.jkconcepts.at/en/website-security-glossary/#session"
        },
        {
          "text": "Passkey",
          "url": "https://www.jkconcepts.at/en/website-security-glossary/#passkey"
        }
      ]
    },
    {
      "type": "paragraph",
      "text": "Identity & access · Basic #authorization",
      "links": [
        {
          "text": "#authorization",
          "url": "https://www.jkconcepts.at/en/website-security-glossary/#authorization"
        }
      ]
    },
    {
      "type": "heading",
      "level": 3,
      "text": "What is authorisation?"
    },
    {
      "type": "paragraph",
      "text": "Authorisation · Permission check"
    },
    {
      "type": "paragraph",
      "text": "Authorisation decides which data and actions an identified person or system may use."
    },
    {
      "type": "heading",
      "level": 3,
      "text": "Technology, example and context"
    },
    {
      "type": "heading",
      "level": 4,
      "text": "Technical explanation"
    },
    {
      "type": "paragraph",
      "text": "Checks must happen on the server for every protected object and every action; roles alone are often not enough for object-specific rules."
    },
    {
      "type": "heading",
      "level": 4,
      "text": "Example"
    },
    {
      "type": "paragraph",
      "text": "An editor may edit content but not manage user accounts."
    },
    {
      "type": "heading",
      "level": 4,
      "text": "Related terms"
    },
    {
      "type": "paragraph",
      "text": "Authentication Least Privilege Privilege Escalation Zero Trust",
      "links": [
        {
          "text": "Authentication",
          "url": "https://www.jkconcepts.at/en/website-security-glossary/#authentication"
        },
        {
          "text": "Least Privilege",
          "url": "https://www.jkconcepts.at/en/website-security-glossary/#least-privilege"
        },
        {
          "text": "Privilege Escalation",
          "url": "https://www.jkconcepts.at/en/website-security-glossary/#privilege-escalation"
        },
        {
          "text": "Zero Trust",
          "url": "https://www.jkconcepts.at/en/website-security-glossary/#zero-trust"
        }
      ]
    },
    {
      "type": "heading",
      "level": 2,
      "text": "Terms starting with B"
    },
    {
      "type": "paragraph",
      "text": "WordPress security · Advanced #backdoor",
      "links": [
        {
          "text": "#backdoor",
          "url": "https://www.jkconcepts.at/en/website-security-glossary/#backdoor"
        }
      ]
    },
    {
      "type": "heading",
      "level": 3,
      "text": "What is a backdoor?"
    },
    {
      "type": "paragraph",
      "text": "Backdoor · Hidden persistent access"
    },
    {
      "type": "paragraph",
      "text": "A backdoor enables hidden access that bypasses regular security controls."
    },
    {
      "type": "heading",
      "level": 3,
      "text": "Technology, example and context"
    },
    {
      "type": "heading",
      "level": 4,
      "text": "Technical explanation"
    },
    {
      "type": "paragraph",
      "text": "Backdoors can persist as obfuscated files, manipulated plugins, database content, user accounts or scheduled tasks."
    },
    {
      "type": "heading",
      "level": 4,
      "text": "Example"
    },
    {
      "type": "paragraph",
      "text": "A seemingly harmless PHP file executes commands from an encrypted request parameter."
    },
    {
      "type": "heading",
      "level": 4,
      "text": "Related terms"
    },
    {
      "type": "paragraph",
      "text": "Malware Remote Code Execution File Integrity Monitoring Malware Scanning",
      "links": [
        {
          "text": "Malware",
          "url": "https://www.jkconcepts.at/en/website-security-glossary/#malware"
        },
        {
          "text": "Remote Code Execution",
          "url": "https://www.jkconcepts.at/en/website-security-glossary/#rce"
        },
        {
          "text": "File Integrity Monitoring",
          "url": "https://www.jkconcepts.at/en/website-security-glossary/#file-integrity-monitoring"
        },
        {
          "text": "Malware Scanning",
          "url": "https://www.jkconcepts.at/en/website-security-glossary/#malware-scanning"
        }
      ]
    },
    {
      "type": "paragraph",
      "text": "Suspect your website is infected? See immediate steps →",
      "links": [
        {
          "text": "See immediate steps →",
          "url": "https://www.jkconcepts.at/en/wordpress-hacked/"
        }
      ]
    },
    {
      "type": "paragraph",
      "text": "Basics · Basic #backend",
      "links": [
        {
          "text": "#backend",
          "url": "https://www.jkconcepts.at/en/website-security-glossary/#backend"
        }
      ]
    },
    {
      "type": "heading",
      "level": 3,
      "text": "What is the backend?"
    },
    {
      "type": "paragraph",
      "text": "Backend · The server-side part of an application"
    },
    {
      "type": "paragraph",
      "text": "The backend handles business logic, data access, permissions and interfaces outside the visible browser interface."
    },
    {
      "type": "heading",
      "level": 3,
      "text": "Technology, example and context"
    },
    {
      "type": "heading",
      "level": 4,
      "text": "Technical explanation"
    },
    {
      "type": "paragraph",
      "text": "Backend processes validate requests, coordinate services and databases and generate HTML or structured API responses."
    },
    {
      "type": "heading",
      "level": 4,
      "text": "Example"
    },
    {
      "type": "paragraph",
      "text": "A contact backend checks inputs, limits abuse and stores an enquiry."
    },
    {
      "type": "heading",
      "level": 4,
      "text": "Related terms"
    },
    {
      "type": "paragraph",
      "text": "Frontend Full Stack API Database",
      "links": [
        {
          "text": "Frontend",
          "url": "https://www.jkconcepts.at/en/web-technology-glossary/#frontend"
        },
        {
          "text": "Full Stack",
          "url": "https://www.jkconcepts.at/en/web-technology-glossary/#full-stack"
        },
        {
          "text": "API",
          "url": "https://www.jkconcepts.at/en/web-technology-glossary/#api"
        },
        {
          "text": "Database",
          "url": "https://www.jkconcepts.at/en/web-technology-glossary/#database"
        }
      ]
    },
    {
      "type": "paragraph",
      "text": "Operations & detection · Basic #backup",
      "links": [
        {
          "text": "#backup",
          "url": "https://www.jkconcepts.at/en/website-security-glossary/#backup"
        }
      ]
    },
    {
      "type": "heading",
      "level": 3,
      "text": "What is a backup?"
    },
    {
      "type": "paragraph",
      "text": "Backup · Restorable data copy"
    },
    {
      "type": "paragraph",
      "text": "A backup is a separate copy of data and configuration from which a system can be restored."
    },
    {
      "type": "heading",
      "level": 3,
      "text": "Technology, example and context"
    },
    {
      "type": "heading",
      "level": 4,
      "text": "Technical explanation"
    },
    {
      "type": "paragraph",
      "text": "Reliable backups have suitable intervals, retention, access protection, off-site copies and regularly tested restore processes."
    },
    {
      "type": "heading",
      "level": 4,
      "text": "Example"
    },
    {
      "type": "paragraph",
      "text": "A website’s files and database are backed up daily, with versions, to separate storage."
    },
    {
      "type": "heading",
      "level": 4,
      "text": "Related terms"
    },
    {
      "type": "paragraph",
      "text": "Disaster Recovery Ransomware WordPress Hardening Monitoring",
      "links": [
        {
          "text": "Disaster Recovery",
          "url": "https://www.jkconcepts.at/en/website-security-glossary/#disaster-recovery"
        },
        {
          "text": "Ransomware",
          "url": "https://www.jkconcepts.at/en/website-security-glossary/#ransomware"
        },
        {
          "text": "WordPress Hardening",
          "url": "https://www.jkconcepts.at/en/website-security-glossary/#wordpress-hardening"
        },
        {
          "text": "Monitoring",
          "url": "https://www.jkconcepts.at/en/website-security-glossary/#monitoring"
        }
      ]
    },
    {
      "type": "paragraph",
      "text": "Ongoing care for updates, backups and monitoring? See WordPress maintenance →",
      "links": [
        {
          "text": "See WordPress maintenance →",
          "url": "https://www.jkconcepts.at/en/wordpress-maintenance/"
        }
      ]
    },
    {
      "type": "paragraph",
      "text": "Attacks · Basic #bot-attack",
      "links": [
        {
          "text": "#bot-attack",
          "url": "https://www.jkconcepts.at/en/website-security-glossary/#bot-attack"
        }
      ]
    },
    {
      "type": "heading",
      "level": 3,
      "text": "What is a bot attack?"
    },
    {
      "type": "paragraph",
      "text": "Bot Attack · Automated attack"
    },
    {
      "type": "paragraph",
      "text": "A bot attack automates abusive actions such as login attempts, scraping, spam or shopping basket manipulation."
    },
    {
      "type": "heading",
      "level": 3,
      "text": "Technology, example and context"
    },
    {
      "type": "heading",
      "level": 4,
      "text": "Technical explanation"
    },
    {
      "type": "paragraph",
      "text": "Detection combines behavioural signals, rate limits, reputation and application-specific rules; IP blocks alone are often not enough."
    },
    {
      "type": "heading",
      "level": 4,
      "text": "Example"
    },
    {
      "type": "paragraph",
      "text": "Automated programs test stolen account data against a shop login."
    },
    {
      "type": "heading",
      "level": 4,
      "text": "Related terms"
    },
    {
      "type": "paragraph",
      "text": "Bot Protection Brute Force Credential Stuffing Rate Limiting",
      "links": [
        {
          "text": "Bot Protection",
          "url": "https://www.jkconcepts.at/en/website-security-glossary/#bot-protection"
        },
        {
          "text": "Brute Force",
          "url": "https://www.jkconcepts.at/en/website-security-glossary/#brute-force"
        },
        {
          "text": "Credential Stuffing",
          "url": "https://www.jkconcepts.at/en/website-security-glossary/#credential-stuffing"
        },
        {
          "text": "Rate Limiting",
          "url": "https://www.jkconcepts.at/en/website-security-glossary/#rate-limiting"
        }
      ]
    },
    {
      "type": "paragraph",
      "text": "Safeguards · Advanced #bot-protection",
      "links": [
        {
          "text": "#bot-protection",
          "url": "https://www.jkconcepts.at/en/website-security-glossary/#bot-protection"
        }
      ]
    },
    {
      "type": "heading",
      "level": 3,
      "text": "What is bot protection?"
    },
    {
      "type": "paragraph",
      "text": "Bot Protection · Protection against automated abuse"
    },
    {
      "type": "paragraph",
      "text": "Bot protection detects and limits automated access without locking out welcome crawlers and real users across the board."
    },
    {
      "type": "heading",
      "level": 3,
      "text": "Technology, example and context"
    },
    {
      "type": "heading",
      "level": 4,
      "text": "Technical explanation"
    },
    {
      "type": "paragraph",
      "text": "Signals include rates, behaviour, browser characteristics, reputation, account context and application-specific flows."
    },
    {
      "type": "heading",
      "level": 4,
      "text": "Example"
    },
    {
      "type": "paragraph",
      "text": "A shop limits automated checkout attempts while still letting search engines crawl."
    },
    {
      "type": "heading",
      "level": 4,
      "text": "Related terms"
    },
    {
      "type": "paragraph",
      "text": "Bot Attack Rate Limiting Web Application Firewall Crawler & AI Crawler",
      "links": [
        {
          "text": "Bot Attack",
          "url": "https://www.jkconcepts.at/en/website-security-glossary/#bot-attack"
        },
        {
          "text": "Rate Limiting",
          "url": "https://www.jkconcepts.at/en/website-security-glossary/#rate-limiting"
        },
        {
          "text": "Web Application Firewall",
          "url": "https://www.jkconcepts.at/en/website-security-glossary/#waf"
        },
        {
          "text": "Crawler & AI Crawler",
          "url": "https://www.jkconcepts.at/en/ai-glossary/#ai-crawler"
        }
      ]
    },
    {
      "type": "paragraph",
      "text": "Attacks · Basic #brute-force",
      "links": [
        {
          "text": "#brute-force",
          "url": "https://www.jkconcepts.at/en/website-security-glossary/#brute-force"
        }
      ]
    },
    {
      "type": "heading",
      "level": 3,
      "text": "What is a brute-force attack?"
    },
    {
      "type": "paragraph",
      "text": "Brute Force · Systematic trial and error"
    },
    {
      "type": "paragraph",
      "text": "A brute-force attack tries many possible credentials or keys automatically."
    },
    {
      "type": "heading",
      "level": 3,
      "text": "Technology, example and context"
    },
    {
      "type": "heading",
      "level": 4,
      "text": "Technical explanation"
    },
    {
      "type": "paragraph",
      "text": "Rate limits, progressive delays, MFA, strong passwords, anomaly detection and safe lockout mechanisms form combined layers of protection."
    },
    {
      "type": "heading",
      "level": 4,
      "text": "Example"
    },
    {
      "type": "paragraph",
      "text": "A bot sends thousands of password attempts against wp-login.php."
    },
    {
      "type": "heading",
      "level": 4,
      "text": "Related terms"
    },
    {
      "type": "paragraph",
      "text": "Credential Stuffing Rate Limiting MFA / 2FA Bot Protection",
      "links": [
        {
          "text": "Credential Stuffing",
          "url": "https://www.jkconcepts.at/en/website-security-glossary/#credential-stuffing"
        },
        {
          "text": "Rate Limiting",
          "url": "https://www.jkconcepts.at/en/website-security-glossary/#rate-limiting"
        },
        {
          "text": "MFA / 2FA",
          "url": "https://www.jkconcepts.at/en/website-security-glossary/#mfa"
        },
        {
          "text": "Bot Protection",
          "url": "https://www.jkconcepts.at/en/website-security-glossary/#bot-protection"
        }
      ]
    },
    {
      "type": "paragraph",
      "text": "Hardening WordPress before something happens? See WordPress security →",
      "links": [
        {
          "text": "See WordPress security →",
          "url": "https://www.jkconcepts.at/en/wordpress-security/"
        }
      ]
    },
    {
      "type": "heading",
      "level": 2,
      "text": "Terms starting with C"
    },
    {
      "type": "paragraph",
      "text": "Web basics · Basic #cdn",
      "links": [
        {
          "text": "#cdn",
          "url": "https://www.jkconcepts.at/en/website-security-glossary/#cdn"
        }
      ]
    },
    {
      "type": "heading",
      "level": 3,
      "text": "What is a CDN?"
    },
    {
      "type": "paragraph",
      "text": "CDN · Content Delivery Network"
    },
    {
      "type": "paragraph",
      "text": "A CDN distributes and stores content across several locations so that it can be delivered closer to visitors."
    },
    {
      "type": "heading",
      "level": 3,
      "text": "Technology, example and context"
    },
    {
      "type": "heading",
      "level": 4,
      "text": "Technical explanation"
    },
    {
      "type": "paragraph",
      "text": "Edge servers answer cacheable requests, often terminate TLS and can add protective functions such as DDoS defence or a WAF."
    },
    {
      "type": "heading",
      "level": 4,
      "text": "Example"
    },
    {
      "type": "paragraph",
      "text": "Images and scripts of an Austrian website are loaded from regional edge locations for international visitors."
    },
    {
      "type": "heading",
      "level": 4,
      "text": "Related terms"
    },
    {
      "type": "paragraph",
      "text": "Cache Web Hosting DDoS Web Application Firewall",
      "links": [
        {
          "text": "Cache",
          "url": "https://www.jkconcepts.at/en/web-technology-glossary/#cache"
        },
        {
          "text": "Web Hosting",
          "url": "https://www.jkconcepts.at/en/web-technology-glossary/#webhosting"
        },
        {
          "text": "DDoS",
          "url": "https://www.jkconcepts.at/en/website-security-glossary/#ddos"
        },
        {
          "text": "Web Application Firewall",
          "url": "https://www.jkconcepts.at/en/website-security-glossary/#waf"
        }
      ]
    },
    {
      "type": "paragraph",
      "text": "Safeguards · Technical #csp",
      "links": [
        {
          "text": "#csp",
          "url": "https://www.jkconcepts.at/en/website-security-glossary/#csp"
        }
      ]
    },
    {
      "type": "heading",
      "level": 3,
      "text": "What is a content security policy?"
    },
    {
      "type": "paragraph",
      "text": "Content Security Policy · CSP"
    },
    {
      "type": "paragraph",
      "text": "A CSP limits the sources from which a page may load scripts, styles, images and other resources."
    },
    {
      "type": "heading",
      "level": 3,
      "text": "Technology, example and context"
    },
    {
      "type": "heading",
      "level": 4,
      "text": "Technical explanation"
    },
    {
      "type": "paragraph",
      "text": "The HTTP policy works with directives and source expressions; nonces or hashes can mark specifically permitted inline code."
    },
    {
      "type": "heading",
      "level": 4,
      "text": "Example"
    },
    {
      "type": "paragraph",
      "text": "script-src 'self' basically only allows scripts from the page’s own origin."
    },
    {
      "type": "heading",
      "level": 4,
      "text": "Why does it matter?"
    },
    {
      "type": "paragraph",
      "text": "A carefully introduced CSP makes XSS harder, but can block legitimate features if misconfigured."
    },
    {
      "type": "heading",
      "level": 4,
      "text": "Related terms"
    },
    {
      "type": "paragraph",
      "text": "Security Headers Cross-Site Scripting Subresource Integrity HTTP Header",
      "links": [
        {
          "text": "Security Headers",
          "url": "https://www.jkconcepts.at/en/website-security-glossary/#security-headers"
        },
        {
          "text": "Cross-Site Scripting",
          "url": "https://www.jkconcepts.at/en/website-security-glossary/#xss"
        },
        {
          "text": "Subresource Integrity",
          "url": "https://www.jkconcepts.at/en/website-security-glossary/#subresource-integrity"
        },
        {
          "text": "HTTP Header",
          "url": "https://www.jkconcepts.at/en/website-security-glossary/#http-header"
        }
      ]
    },
    {
      "type": "paragraph",
      "text": "Securing your website technically? See website security →",
      "links": [
        {
          "text": "See website security →",
          "url": "https://www.jkconcepts.at/en/wordpress-security/"
        }
      ]
    },
    {
      "type": "paragraph",
      "text": "Web basics · Basic #cookie",
      "links": [
        {
          "text": "#cookie",
          "url": "https://www.jkconcepts.at/en/website-security-glossary/#cookie"
        }
      ]
    },
    {
      "type": "heading",
      "level": 3,
      "text": "What are cookies?"
    },
    {
      "type": "paragraph",
      "text": "Cookie · HTTP value stored by the browser"
    },
    {
      "type": "paragraph",
      "text": "A cookie is a small value that a website can set in the browser and have sent along with matching later requests."
    },
    {
      "type": "heading",
      "level": 3,
      "text": "Technology, example and context"
    },
    {
      "type": "heading",
      "level": 4,
      "text": "Technical explanation"
    },
    {
      "type": "paragraph",
      "text": "Attributes such as Domain, Path, Expires, Secure, HttpOnly and SameSite limit lifetime and transmission."
    },
    {
      "type": "heading",
      "level": 4,
      "text": "Example"
    },
    {
      "type": "paragraph",
      "text": "A random session identifier connects several requests to a logged-in session."
    },
    {
      "type": "heading",
      "level": 4,
      "text": "Why does it matter?"
    },
    {
      "type": "paragraph",
      "text": "Cookies can be technically necessary or require consent and transparent privacy information."
    },
    {
      "type": "heading",
      "level": 4,
      "text": "Related terms"
    },
    {
      "type": "paragraph",
      "text": "Session SameSite Cookie HttpOnly Secure Cookie",
      "links": [
        {
          "text": "Session",
          "url": "https://www.jkconcepts.at/en/website-security-glossary/#session"
        },
        {
          "text": "SameSite Cookie",
          "url": "https://www.jkconcepts.at/en/website-security-glossary/#samesite-cookie"
        },
        {
          "text": "HttpOnly",
          "url": "https://www.jkconcepts.at/en/website-security-glossary/#httponly"
        },
        {
          "text": "Secure Cookie",
          "url": "https://www.jkconcepts.at/en/website-security-glossary/#secure-cookie"
        }
      ]
    },
    {
      "type": "paragraph",
      "text": "Safeguards · Technical #cors",
      "links": [
        {
          "text": "#cors",
          "url": "https://www.jkconcepts.at/en/website-security-glossary/#cors"
        }
      ]
    },
    {
      "type": "heading",
      "level": 3,
      "text": "What is CORS?"
    },
    {
      "type": "paragraph",
      "text": "CORS · Cross-Origin Resource Sharing"
    },
    {
      "type": "paragraph",
      "text": "CORS controls which other origins browsers may allow to access a server’s resources."
    },
    {
      "type": "heading",
      "level": 3,
      "text": "Technology, example and context"
    },
    {
      "type": "heading",
      "level": 4,
      "text": "Technical explanation"
    },
    {
      "type": "paragraph",
      "text": "Servers set Access-Control-Allow-* headers; non-simple requests can trigger an OPTIONS preflight. CORS is not server-side authentication."
    },
    {
      "type": "heading",
      "level": 4,
      "text": "Example"
    },
    {
      "type": "paragraph",
      "text": "An API only allows browser access from the frontend’s production domain."
    },
    {
      "type": "heading",
      "level": 4,
      "text": "Related terms"
    },
    {
      "type": "paragraph",
      "text": "HTTP Header API CSRF Authentication",
      "links": [
        {
          "text": "HTTP Header",
          "url": "https://www.jkconcepts.at/en/website-security-glossary/#http-header"
        },
        {
          "text": "API",
          "url": "https://www.jkconcepts.at/en/web-technology-glossary/#api"
        },
        {
          "text": "CSRF",
          "url": "https://www.jkconcepts.at/en/website-security-glossary/#csrf"
        },
        {
          "text": "Authentication",
          "url": "https://www.jkconcepts.at/en/website-security-glossary/#authentication"
        }
      ]
    },
    {
      "type": "paragraph",
      "text": "Attacks · Advanced #credential-stuffing",
      "links": [
        {
          "text": "#credential-stuffing",
          "url": "https://www.jkconcepts.at/en/website-security-glossary/#credential-stuffing"
        }
      ]
    },
    {
      "type": "heading",
      "level": 3,
      "text": "What is credential stuffing?"
    },
    {
      "type": "paragraph",
      "text": "Credential Stuffing · Reuse of stolen credentials"
    },
    {
      "type": "paragraph",
      "text": "Credential stuffing automatically tests known combinations of email address and password on other services."
    },
    {
      "type": "heading",
      "level": 3,
      "text": "Technology, example and context"
    },
    {
      "type": "heading",
      "level": 4,
      "text": "Technical explanation"
    },
    {
      "type": "paragraph",
      "text": "The attack exploits password reuse rather than a vulnerability in the target; MFA, passkeys, rate limits and leaked-credential checks help."
    },
    {
      "type": "heading",
      "level": 4,
      "text": "Example"
    },
    {
      "type": "paragraph",
      "text": "Data from someone else’s data leak is tested against a shop’s customer login."
    },
    {
      "type": "heading",
      "level": 4,
      "text": "Related terms"
    },
    {
      "type": "paragraph",
      "text": "Brute Force Phishing MFA / 2FA Passkey",
      "links": [
        {
          "text": "Brute Force",
          "url": "https://www.jkconcepts.at/en/website-security-glossary/#brute-force"
        },
        {
          "text": "Phishing",
          "url": "https://www.jkconcepts.at/en/website-security-glossary/#phishing"
        },
        {
          "text": "MFA / 2FA",
          "url": "https://www.jkconcepts.at/en/website-security-glossary/#mfa"
        },
        {
          "text": "Passkey",
          "url": "https://www.jkconcepts.at/en/website-security-glossary/#passkey"
        }
      ]
    },
    {
      "type": "paragraph",
      "text": "Attacks · Advanced #xss",
      "links": [
        {
          "text": "#xss",
          "url": "https://www.jkconcepts.at/en/website-security-glossary/#xss"
        }
      ]
    },
    {
      "type": "heading",
      "level": 3,
      "text": "What is cross-site scripting?"
    },
    {
      "type": "paragraph",
      "text": "Cross-Site Scripting · XSS"
    },
    {
      "type": "paragraph",
      "text": "XSS allows untrusted content to be executed as active code in other users’ browsers."
    },
    {
      "type": "heading",
      "level": 3,
      "text": "Technology, example and context"
    },
    {
      "type": "heading",
      "level": 4,
      "text": "Technical explanation"
    },
    {
      "type": "paragraph",
      "text": "Context-specific output encoding, safe DOM APIs, sanitising and a restrictive CSP form the central layers of protection."
    },
    {
      "type": "heading",
      "level": 4,
      "text": "Example"
    },
    {
      "type": "paragraph",
      "text": "An unfiltered comment is output as HTML and contains an executable script element."
    },
    {
      "type": "heading",
      "level": 4,
      "text": "Related terms"
    },
    {
      "type": "paragraph",
      "text": "Content Security Policy HttpOnly Input Validation Session Hijacking",
      "links": [
        {
          "text": "Content Security Policy",
          "url": "https://www.jkconcepts.at/en/website-security-glossary/#csp"
        },
        {
          "text": "HttpOnly",
          "url": "https://www.jkconcepts.at/en/website-security-glossary/#httponly"
        },
        {
          "text": "Input Validation",
          "url": "https://www.jkconcepts.at/en/website-security-glossary/#input-validation"
        },
        {
          "text": "Session Hijacking",
          "url": "https://www.jkconcepts.at/en/website-security-glossary/#session-hijacking"
        }
      ]
    },
    {
      "type": "paragraph",
      "text": "Attacks · Advanced #csrf",
      "links": [
        {
          "text": "#csrf",
          "url": "https://www.jkconcepts.at/en/website-security-glossary/#csrf"
        }
      ]
    },
    {
      "type": "heading",
      "level": 3,
      "text": "What is CSRF?"
    },
    {
      "type": "paragraph",
      "text": "CSRF · Cross-Site Request Forgery"
    },
    {
      "type": "paragraph",
      "text": "CSRF makes a logged-in browser send a state-changing request without the user intending to."
    },
    {
      "type": "heading",
      "level": 3,
      "text": "Technology, example and context"
    },
    {
      "type": "heading",
      "level": 4,
      "text": "Technical explanation"
    },
    {
      "type": "paragraph",
      "text": "Synchroniser tokens, SameSite cookies, origin checks and safe HTTP methods reduce the risk; XSS can bypass many CSRF protections."
    },
    {
      "type": "heading",
      "level": 4,
      "text": "Example"
    },
    {
      "type": "paragraph",
      "text": "A third-party page triggers an account change in the background on a service where you are already logged in."
    },
    {
      "type": "heading",
      "level": 4,
      "text": "Related terms"
    },
    {
      "type": "paragraph",
      "text": "Cookie SameSite Cookie Cross-Site Scripting WordPress Nonce",
      "links": [
        {
          "text": "Cookie",
          "url": "https://www.jkconcepts.at/en/website-security-glossary/#cookie"
        },
        {
          "text": "SameSite Cookie",
          "url": "https://www.jkconcepts.at/en/website-security-glossary/#samesite-cookie"
        },
        {
          "text": "Cross-Site Scripting",
          "url": "https://www.jkconcepts.at/en/website-security-glossary/#xss"
        },
        {
          "text": "WordPress Nonce",
          "url": "https://www.jkconcepts.at/en/website-security-glossary/#wordpress-nonce"
        }
      ]
    },
    {
      "type": "paragraph",
      "text": "Basics · Advanced #cve",
      "links": [
        {
          "text": "#cve",
          "url": "https://www.jkconcepts.at/en/website-security-glossary/#cve"
        }
      ]
    },
    {
      "type": "heading",
      "level": 3,
      "text": "What is a CVE?"
    },
    {
      "type": "paragraph",
      "text": "CVE · Common Vulnerabilities and Exposures"
    },
    {
      "type": "paragraph",
      "text": "A CVE ID uniquely identifies a specific, publicly recorded security vulnerability."
    },
    {
      "type": "heading",
      "level": 3,
      "text": "Technology, example and context"
    },
    {
      "type": "heading",
      "level": 4,
      "text": "Technical explanation"
    },
    {
      "type": "paragraph",
      "text": "The identifier makes it referenceable, while the description, affected versions, rating and countermeasures come from advisories and databases."
    },
    {
      "type": "heading",
      "level": 4,
      "text": "Example"
    },
    {
      "type": "paragraph",
      "text": "A vendor advisory names a CVE and the first patched plugin version."
    },
    {
      "type": "heading",
      "level": 4,
      "text": "Related terms"
    },
    {
      "type": "paragraph",
      "text": "Vulnerability CWE CVSS Security Patch",
      "links": [
        {
          "text": "Vulnerability",
          "url": "https://www.jkconcepts.at/en/website-security-glossary/#vulnerability"
        },
        {
          "text": "CWE",
          "url": "https://www.jkconcepts.at/en/website-security-glossary/#cwe"
        },
        {
          "text": "CVSS",
          "url": "https://www.jkconcepts.at/en/website-security-glossary/#cvss"
        },
        {
          "text": "Security Patch",
          "url": "https://www.jkconcepts.at/en/website-security-glossary/#patch"
        }
      ]
    },
    {
      "type": "paragraph",
      "text": "Basics · Technical #cvss",
      "links": [
        {
          "text": "#cvss",
          "url": "https://www.jkconcepts.at/en/website-security-glossary/#cvss"
        }
      ]
    },
    {
      "type": "heading",
      "level": 3,
      "text": "What is a CVSS score?"
    },
    {
      "type": "paragraph",
      "text": "CVSS · Common Vulnerability Scoring System"
    },
    {
      "type": "paragraph",
      "text": "CVSS describes the technical characteristics and severity of a vulnerability as a standardised vector and numerical value."
    },
    {
      "type": "heading",
      "level": 3,
      "text": "Technology, example and context"
    },
    {
      "type": "heading",
      "level": 4,
      "text": "Technical explanation"
    },
    {
      "type": "paragraph",
      "text": "The base score alone does not determine the operational risk; exposure, affected data, active exploitation and existing controls belong in the prioritisation."
    },
    {
      "type": "heading",
      "level": 4,
      "text": "Example"
    },
    {
      "type": "paragraph",
      "text": "A highly rated vulnerability in a deactivated component may be prioritised differently from an actively exploited medium one."
    },
    {
      "type": "heading",
      "level": 4,
      "text": "Related terms"
    },
    {
      "type": "paragraph",
      "text": "CVE Vulnerability Exploit Security Patch",
      "links": [
        {
          "text": "CVE",
          "url": "https://www.jkconcepts.at/en/website-security-glossary/#cve"
        },
        {
          "text": "Vulnerability",
          "url": "https://www.jkconcepts.at/en/website-security-glossary/#vulnerability"
        },
        {
          "text": "Exploit",
          "url": "https://www.jkconcepts.at/en/website-security-glossary/#exploit"
        },
        {
          "text": "Security Patch",
          "url": "https://www.jkconcepts.at/en/website-security-glossary/#patch"
        }
      ]
    },
    {
      "type": "paragraph",
      "text": "Basics · Technical #cwe",
      "links": [
        {
          "text": "#cwe",
          "url": "https://www.jkconcepts.at/en/website-security-glossary/#cwe"
        }
      ]
    },
    {
      "type": "heading",
      "level": 3,
      "text": "What is CWE?"
    },
    {
      "type": "paragraph",
      "text": "CWE · Common Weakness Enumeration"
    },
    {
      "type": "paragraph",
      "text": "CWE classifies general types of software and hardware weaknesses."
    },
    {
      "type": "heading",
      "level": 3,
      "text": "Technology, example and context"
    },
    {
      "type": "heading",
      "level": 4,
      "text": "Technical explanation"
    },
    {
      "type": "paragraph",
      "text": "A CVE typically describes a specific vulnerability in a product, a CWE the underlying error pattern."
    },
    {
      "type": "heading",
      "level": 4,
      "text": "Example"
    },
    {
      "type": "paragraph",
      "text": "SQL injection is a type of weakness; specific affected plugin versions may receive CVE IDs."
    },
    {
      "type": "heading",
      "level": 4,
      "text": "Related terms"
    },
    {
      "type": "paragraph",
      "text": "CVE Vulnerability SQL Injection Cross-Site Scripting",
      "links": [
        {
          "text": "CVE",
          "url": "https://www.jkconcepts.at/en/website-security-glossary/#cve"
        },
        {
          "text": "Vulnerability",
          "url": "https://www.jkconcepts.at/en/website-security-glossary/#vulnerability"
        },
        {
          "text": "SQL Injection",
          "url": "https://www.jkconcepts.at/en/website-security-glossary/#sql-injection"
        },
        {
          "text": "Cross-Site Scripting",
          "url": "https://www.jkconcepts.at/en/website-security-glossary/#xss"
        }
      ]
    },
    {
      "type": "paragraph",
      "text": "Basics · Basic #cybersecurity",
      "links": [
        {
          "text": "#cybersecurity",
          "url": "https://www.jkconcepts.at/en/website-security-glossary/#cybersecurity"
        }
      ]
    },
    {
      "type": "heading",
      "level": 3,
      "text": "What is cybersecurity?"
    },
    {
      "type": "paragraph",
      "text": "Cybersecurity · Information and IT security"
    },
    {
      "type": "paragraph",
      "text": "Cybersecurity protects digital systems, data and services against attacks, misuse and unintentional damage."
    },
    {
      "type": "heading",
      "level": 3,
      "text": "Technology, example and context"
    },
    {
      "type": "heading",
      "level": 4,
      "text": "Technical explanation"
    },
    {
      "type": "paragraph",
      "text": "The field covers prevention, detection, response and recovery across identities, applications, networks, devices and processes."
    },
    {
      "type": "heading",
      "level": 4,
      "text": "Example"
    },
    {
      "type": "paragraph",
      "text": "Access controls, secure configuration, logging and emergency plans reduce the risk together."
    },
    {
      "type": "heading",
      "level": 4,
      "text": "Related terms"
    },
    {
      "type": "paragraph",
      "text": "Website Security Zero Trust Monitoring Disaster Recovery",
      "links": [
        {
          "text": "Website Security",
          "url": "https://www.jkconcepts.at/en/website-security-glossary/#website-security"
        },
        {
          "text": "Zero Trust",
          "url": "https://www.jkconcepts.at/en/website-security-glossary/#zero-trust"
        },
        {
          "text": "Monitoring",
          "url": "https://www.jkconcepts.at/en/website-security-glossary/#monitoring"
        },
        {
          "text": "Disaster Recovery",
          "url": "https://www.jkconcepts.at/en/website-security-glossary/#disaster-recovery"
        }
      ]
    },
    {
      "type": "heading",
      "level": 2,
      "text": "Terms starting with D"
    },
    {
      "type": "paragraph",
      "text": "AI security · Advanced #datenschutz",
      "links": [
        {
          "text": "#datenschutz",
          "url": "https://www.jkconcepts.at/en/website-security-glossary/#datenschutz"
        }
      ]
    },
    {
      "type": "heading",
      "level": 3,
      "text": "What does Data Protection mean?"
    },
    {
      "type": "paragraph",
      "text": "Data Protection · Protection of personal data"
    },
    {
      "type": "paragraph",
      "text": "Rules and measures for the lawful, purpose-bound and secure processing of personal data."
    },
    {
      "type": "heading",
      "level": 3,
      "text": "Technology, example and context"
    },
    {
      "type": "heading",
      "level": 4,
      "text": "Example"
    },
    {
      "type": "paragraph",
      "text": "Before using an AI service, the purpose, necessary data, provider, storage location, contracts and deletion periods are checked."
    },
    {
      "type": "heading",
      "level": 4,
      "text": "Why does it matter?"
    },
    {
      "type": "paragraph",
      "text": "AI doesn’t change the principles of data protection. What matters is the specific data flow, not the label of the tool used."
    },
    {
      "type": "heading",
      "level": 4,
      "text": "Related terms"
    },
    {
      "type": "paragraph",
      "text": "PII Pseudonymisation Cloud AI",
      "links": [
        {
          "text": "PII",
          "url": "https://www.jkconcepts.at/en/ai-glossary/#pii"
        },
        {
          "text": "Pseudonymisation",
          "url": "https://www.jkconcepts.at/en/ai-glossary/#pseudonymisierung"
        },
        {
          "text": "Cloud AI",
          "url": "https://www.jkconcepts.at/en/ai-glossary/#cloud-ai"
        }
      ]
    },
    {
      "type": "paragraph",
      "text": "Attacks · Basic #ddos",
      "links": [
        {
          "text": "#ddos",
          "url": "https://www.jkconcepts.at/en/website-security-glossary/#ddos"
        }
      ]
    },
    {
      "type": "heading",
      "level": 3,
      "text": "What is a DDoS attack?"
    },
    {
      "type": "paragraph",
      "text": "DDoS · Distributed Denial of Service"
    },
    {
      "type": "paragraph",
      "text": "A DDoS attack tries to overload a service with distributed requests or data streams."
    },
    {
      "type": "heading",
      "level": 3,
      "text": "Technology, example and context"
    },
    {
      "type": "heading",
      "level": 4,
      "text": "Technical explanation"
    },
    {
      "type": "paragraph",
      "text": "Protection is implemented at network, protocol and application level and often needs upstream anycast, CDN or scrubbing infrastructure."
    },
    {
      "type": "heading",
      "level": 4,
      "text": "Example"
    },
    {
      "type": "paragraph",
      "text": "Many compromised devices send requests to an online shop at the same time."
    },
    {
      "type": "heading",
      "level": 4,
      "text": "Related terms"
    },
    {
      "type": "paragraph",
      "text": "CDN Rate Limiting Bot Attack Monitoring",
      "links": [
        {
          "text": "CDN",
          "url": "https://www.jkconcepts.at/en/website-security-glossary/#cdn"
        },
        {
          "text": "Rate Limiting",
          "url": "https://www.jkconcepts.at/en/website-security-glossary/#rate-limiting"
        },
        {
          "text": "Bot Attack",
          "url": "https://www.jkconcepts.at/en/website-security-glossary/#bot-attack"
        },
        {
          "text": "Monitoring",
          "url": "https://www.jkconcepts.at/en/website-security-glossary/#monitoring"
        }
      ]
    },
    {
      "type": "paragraph",
      "text": "Attacks · Technical #dependency-confusion",
      "links": [
        {
          "text": "#dependency-confusion",
          "url": "https://www.jkconcepts.at/en/website-security-glossary/#dependency-confusion"
        }
      ]
    },
    {
      "type": "heading",
      "level": 3,
      "text": "What is dependency confusion?"
    },
    {
      "type": "paragraph",
      "text": "Dependency Confusion · Mixing up internal and public packages"
    },
    {
      "type": "paragraph",
      "text": "Dependency confusion tricks a build system into loading a malicious public package instead of an intended internal dependency."
    },
    {
      "type": "heading",
      "level": 3,
      "text": "Technology, example and context"
    },
    {
      "type": "heading",
      "level": 4,
      "text": "Technical explanation"
    },
    {
      "type": "paragraph",
      "text": "Unique namespaces, fixed registries, lockfiles and controlled resolution prevent surprising changes of source."
    },
    {
      "type": "heading",
      "level": 4,
      "text": "Example"
    },
    {
      "type": "paragraph",
      "text": "A publicly released package has the same name as an internal library and a higher version number."
    },
    {
      "type": "heading",
      "level": 4,
      "text": "Related terms"
    },
    {
      "type": "paragraph",
      "text": "Software Supply Chain Attack Subresource Integrity Least Privilege",
      "links": [
        {
          "text": "Software Supply Chain Attack",
          "url": "https://www.jkconcepts.at/en/website-security-glossary/#supply-chain-attack"
        },
        {
          "text": "Subresource Integrity",
          "url": "https://www.jkconcepts.at/en/website-security-glossary/#subresource-integrity"
        },
        {
          "text": "Least Privilege",
          "url": "https://www.jkconcepts.at/en/website-security-glossary/#least-privilege"
        }
      ]
    },
    {
      "type": "paragraph",
      "text": "Operations & detection · Advanced #disaster-recovery",
      "links": [
        {
          "text": "#disaster-recovery",
          "url": "https://www.jkconcepts.at/en/website-security-glossary/#disaster-recovery"
        }
      ]
    },
    {
      "type": "heading",
      "level": 3,
      "text": "What is disaster recovery?"
    },
    {
      "type": "paragraph",
      "text": "Disaster Recovery · Planned recovery after an outage"
    },
    {
      "type": "paragraph",
      "text": "Disaster recovery describes prepared processes for restoring systems and data after serious disruptions."
    },
    {
      "type": "heading",
      "level": 3,
      "text": "Technology, example and context"
    },
    {
      "type": "heading",
      "level": 4,
      "text": "Technical explanation"
    },
    {
      "type": "paragraph",
      "text": "Targets such as RTO and RPO, responsibilities, alternative infrastructure, key material and tested runbooks determine how restorable a system really is."
    },
    {
      "type": "heading",
      "level": 4,
      "text": "Example"
    },
    {
      "type": "paragraph",
      "text": "After a server failure, the website is started on new infrastructure from a verified backup."
    },
    {
      "type": "heading",
      "level": 4,
      "text": "Related terms"
    },
    {
      "type": "paragraph",
      "text": "Backup Monitoring Logging Ransomware",
      "links": [
        {
          "text": "Backup",
          "url": "https://www.jkconcepts.at/en/website-security-glossary/#backup"
        },
        {
          "text": "Monitoring",
          "url": "https://www.jkconcepts.at/en/website-security-glossary/#monitoring"
        },
        {
          "text": "Logging",
          "url": "https://www.jkconcepts.at/en/website-security-glossary/#logging"
        },
        {
          "text": "Ransomware",
          "url": "https://www.jkconcepts.at/en/website-security-glossary/#ransomware"
        }
      ]
    },
    {
      "type": "heading",
      "level": 2,
      "text": "Terms starting with E"
    },
    {
      "type": "paragraph",
      "text": "Safeguards · Basic #encryption",
      "links": [
        {
          "text": "#encryption",
          "url": "https://www.jkconcepts.at/en/website-security-glossary/#encryption"
        }
      ]
    },
    {
      "type": "heading",
      "level": 3,
      "text": "What is encryption?"
    },
    {
      "type": "paragraph",
      "text": "Encryption · Making data unreadable without a key"
    },
    {
      "type": "paragraph",
      "text": "Encryption uses a key to turn data into a form that cannot be read directly and is reversible in principle."
    },
    {
      "type": "heading",
      "level": 3,
      "text": "Technology, example and context"
    },
    {
      "type": "heading",
      "level": 4,
      "text": "Technical explanation"
    },
    {
      "type": "paragraph",
      "text": "Symmetric methods use the same secret key, asymmetric ones a matching pair of public and private keys."
    },
    {
      "type": "heading",
      "level": 4,
      "text": "Example"
    },
    {
      "type": "paragraph",
      "text": "TLS encrypts data in transit between browser and server."
    },
    {
      "type": "heading",
      "level": 4,
      "text": "Related terms"
    },
    {
      "type": "paragraph",
      "text": "Hashing TLS HTTPS TLS Certificate",
      "links": [
        {
          "text": "Hashing",
          "url": "https://www.jkconcepts.at/en/website-security-glossary/#hashing"
        },
        {
          "text": "TLS",
          "url": "https://www.jkconcepts.at/en/website-security-glossary/#tls"
        },
        {
          "text": "HTTPS",
          "url": "https://www.jkconcepts.at/en/website-security-glossary/#https"
        },
        {
          "text": "TLS Certificate",
          "url": "https://www.jkconcepts.at/en/website-security-glossary/#certificate"
        }
      ]
    },
    {
      "type": "paragraph",
      "text": "Basics · Advanced #exploit",
      "links": [
        {
          "text": "#exploit",
          "url": "https://www.jkconcepts.at/en/website-security-glossary/#exploit"
        }
      ]
    },
    {
      "type": "heading",
      "level": 3,
      "text": "What is an exploit?"
    },
    {
      "type": "paragraph",
      "text": "Exploit · Taking advantage of a vulnerability"
    },
    {
      "type": "paragraph",
      "text": "An exploit is a method or piece of code that deliberately takes advantage of a vulnerability."
    },
    {
      "type": "heading",
      "level": 3,
      "text": "Technology, example and context"
    },
    {
      "type": "heading",
      "level": 4,
      "text": "Technical explanation"
    },
    {
      "type": "paragraph",
      "text": "The impact ranges from information disclosure through privilege escalation to arbitrary code execution; prerequisites can be a version, configuration or user interaction."
    },
    {
      "type": "heading",
      "level": 4,
      "text": "Example"
    },
    {
      "type": "paragraph",
      "text": "A specially crafted request triggers an error and bypasses an access control."
    },
    {
      "type": "heading",
      "level": 4,
      "text": "Related terms"
    },
    {
      "type": "paragraph",
      "text": "Vulnerability Zero-Day Remote Code Execution Privilege Escalation",
      "links": [
        {
          "text": "Vulnerability",
          "url": "https://www.jkconcepts.at/en/website-security-glossary/#vulnerability"
        },
        {
          "text": "Zero-Day",
          "url": "https://www.jkconcepts.at/en/website-security-glossary/#zero-day"
        },
        {
          "text": "Remote Code Execution",
          "url": "https://www.jkconcepts.at/en/website-security-glossary/#rce"
        },
        {
          "text": "Privilege Escalation",
          "url": "https://www.jkconcepts.at/en/website-security-glossary/#privilege-escalation"
        }
      ]
    },
    {
      "type": "heading",
      "level": 2,
      "text": "Terms starting with F"
    },
    {
      "type": "paragraph",
      "text": "Attacks · Technical #file-inclusion",
      "links": [
        {
          "text": "#file-inclusion",
          "url": "https://www.jkconcepts.at/en/website-security-glossary/#file-inclusion"
        }
      ]
    },
    {
      "type": "heading",
      "level": 3,
      "text": "What are LFI and RFI?"
    },
    {
      "type": "paragraph",
      "text": "File Inclusion · Unsafe inclusion of files"
    },
    {
      "type": "paragraph",
      "text": "File inclusion arises when untrusted input determines which file an application loads or executes."
    },
    {
      "type": "heading",
      "level": 3,
      "text": "Technology, example and context"
    },
    {
      "type": "heading",
      "level": 4,
      "text": "Technical explanation"
    },
    {
      "type": "paragraph",
      "text": "LFI targets local sources, RFI remote ones; fixed mappings instead of dynamic paths and minimal runtime permissions reduce the risk."
    },
    {
      "type": "heading",
      "level": 4,
      "text": "Example"
    },
    {
      "type": "paragraph",
      "text": "A template parameter is passed unchecked to a server-side include function."
    },
    {
      "type": "heading",
      "level": 4,
      "text": "Related terms"
    },
    {
      "type": "paragraph",
      "text": "Path Traversal Remote Code Execution Input Validation",
      "links": [
        {
          "text": "Path Traversal",
          "url": "https://www.jkconcepts.at/en/website-security-glossary/#path-traversal"
        },
        {
          "text": "Remote Code Execution",
          "url": "https://www.jkconcepts.at/en/website-security-glossary/#rce"
        },
        {
          "text": "Input Validation",
          "url": "https://www.jkconcepts.at/en/website-security-glossary/#input-validation"
        }
      ]
    },
    {
      "type": "paragraph",
      "text": "Operations & detection · Advanced #file-integrity-monitoring",
      "links": [
        {
          "text": "#file-integrity-monitoring",
          "url": "https://www.jkconcepts.at/en/website-security-glossary/#file-integrity-monitoring"
        }
      ]
    },
    {
      "type": "heading",
      "level": 3,
      "text": "What is file integrity monitoring?"
    },
    {
      "type": "paragraph",
      "text": "File Integrity Monitoring · Monitoring file changes"
    },
    {
      "type": "paragraph",
      "text": "File integrity monitoring detects unexpected changes to monitored files."
    },
    {
      "type": "heading",
      "level": 3,
      "text": "Technology, example and context"
    },
    {
      "type": "heading",
      "level": 4,
      "text": "Technical explanation"
    },
    {
      "type": "paragraph",
      "text": "Comparisons use hashes, known vendor versions or controlled baselines; legitimate deployments must be distinguishable from suspicious changes."
    },
    {
      "type": "heading",
      "level": 4,
      "text": "Example"
    },
    {
      "type": "paragraph",
      "text": "An alert reports a new PHP file in an upload directory."
    },
    {
      "type": "heading",
      "level": 4,
      "text": "Related terms"
    },
    {
      "type": "paragraph",
      "text": "Malware Backdoor Logging WordPress Hardening",
      "links": [
        {
          "text": "Malware",
          "url": "https://www.jkconcepts.at/en/website-security-glossary/#malware"
        },
        {
          "text": "Backdoor",
          "url": "https://www.jkconcepts.at/en/website-security-glossary/#backdoor"
        },
        {
          "text": "Logging",
          "url": "https://www.jkconcepts.at/en/website-security-glossary/#logging"
        },
        {
          "text": "WordPress Hardening",
          "url": "https://www.jkconcepts.at/en/website-security-glossary/#wordpress-hardening"
        }
      ]
    },
    {
      "type": "paragraph",
      "text": "Securing your website technically? See website security →",
      "links": [
        {
          "text": "See website security →",
          "url": "https://www.jkconcepts.at/en/wordpress-security/"
        }
      ]
    },
    {
      "type": "paragraph",
      "text": "Safeguards · Basic #firewall",
      "links": [
        {
          "text": "#firewall",
          "url": "https://www.jkconcepts.at/en/website-security-glossary/#firewall"
        }
      ]
    },
    {
      "type": "heading",
      "level": 3,
      "text": "What is a firewall?"
    },
    {
      "type": "paragraph",
      "text": "Firewall · Control point for network traffic"
    },
    {
      "type": "paragraph",
      "text": "A firewall allows or blocks network traffic based on defined rules."
    },
    {
      "type": "heading",
      "level": 3,
      "text": "Technology, example and context"
    },
    {
      "type": "heading",
      "level": 4,
      "text": "Technical explanation"
    },
    {
      "type": "paragraph",
      "text": "Depending on the layer, addresses, ports, connection states, protocols or application characteristics are evaluated."
    },
    {
      "type": "heading",
      "level": 4,
      "text": "Example"
    },
    {
      "type": "paragraph",
      "text": "A database port can only be reached from the internal application network."
    },
    {
      "type": "heading",
      "level": 4,
      "text": "Related terms"
    },
    {
      "type": "paragraph",
      "text": "Web Application Firewall IP Blocking Least Privilege Zero Trust",
      "links": [
        {
          "text": "Web Application Firewall",
          "url": "https://www.jkconcepts.at/en/website-security-glossary/#waf"
        },
        {
          "text": "IP Blocking",
          "url": "https://www.jkconcepts.at/en/website-security-glossary/#ip-blocking"
        },
        {
          "text": "Least Privilege",
          "url": "https://www.jkconcepts.at/en/website-security-glossary/#least-privilege"
        },
        {
          "text": "Zero Trust",
          "url": "https://www.jkconcepts.at/en/website-security-glossary/#zero-trust"
        }
      ]
    },
    {
      "type": "heading",
      "level": 2,
      "text": "Terms starting with H"
    },
    {
      "type": "paragraph",
      "text": "Safeguards · Advanced #hashing",
      "links": [
        {
          "text": "#hashing",
          "url": "https://www.jkconcepts.at/en/website-security-glossary/#hashing"
        }
      ]
    },
    {
      "type": "heading",
      "level": 3,
      "text": "What is hashing?"
    },
    {
      "type": "paragraph",
      "text": "Hashing · One-way mapping of data"
    },
    {
      "type": "paragraph",
      "text": "Hashing produces a fixed-length value from data, with no intended way of reversing it."
    },
    {
      "type": "heading",
      "level": 3,
      "text": "Technology, example and context"
    },
    {
      "type": "heading",
      "level": 4,
      "text": "Technical explanation"
    },
    {
      "type": "paragraph",
      "text": "Passwords need slow, memory-intensive methods with an individual salt; fast checksums such as SHA-256 alone are unsuitable for this."
    },
    {
      "type": "heading",
      "level": 4,
      "text": "Example"
    },
    {
      "type": "paragraph",
      "text": "A login compares an Argon2id hash instead of a stored plain-text password."
    },
    {
      "type": "heading",
      "level": 4,
      "text": "Related terms"
    },
    {
      "type": "paragraph",
      "text": "Encryption Authentication WordPress Security Keys",
      "links": [
        {
          "text": "Encryption",
          "url": "https://www.jkconcepts.at/en/website-security-glossary/#encryption"
        },
        {
          "text": "Authentication",
          "url": "https://www.jkconcepts.at/en/website-security-glossary/#authentication"
        },
        {
          "text": "WordPress Security Keys",
          "url": "https://www.jkconcepts.at/en/website-security-glossary/#wordpress-security-keys"
        }
      ]
    },
    {
      "type": "paragraph",
      "text": "Safeguards · Advanced #hsts",
      "links": [
        {
          "text": "#hsts",
          "url": "https://www.jkconcepts.at/en/website-security-glossary/#hsts"
        }
      ]
    },
    {
      "type": "heading",
      "level": 3,
      "text": "What is HSTS?"
    },
    {
      "type": "paragraph",
      "text": "HSTS · HTTP Strict Transport Security"
    },
    {
      "type": "paragraph",
      "text": "HSTS instructs browsers to access a domain only via HTTPS for a defined period."
    },
    {
      "type": "heading",
      "level": 3,
      "text": "Technology, example and context"
    },
    {
      "type": "heading",
      "level": 4,
      "text": "Technical explanation"
    },
    {
      "type": "paragraph",
      "text": "The Strict-Transport-Security header can include subdomains; preloading also reduces the risk on the very first visit."
    },
    {
      "type": "heading",
      "level": 4,
      "text": "Example"
    },
    {
      "type": "paragraph",
      "text": "A browser locally replaces a later http request with https."
    },
    {
      "type": "heading",
      "level": 4,
      "text": "Related terms"
    },
    {
      "type": "paragraph",
      "text": "HTTPS TLS Security Headers TLS Certificate",
      "links": [
        {
          "text": "HTTPS",
          "url": "https://www.jkconcepts.at/en/website-security-glossary/#https"
        },
        {
          "text": "TLS",
          "url": "https://www.jkconcepts.at/en/website-security-glossary/#tls"
        },
        {
          "text": "Security Headers",
          "url": "https://www.jkconcepts.at/en/website-security-glossary/#security-headers"
        },
        {
          "text": "TLS Certificate",
          "url": "https://www.jkconcepts.at/en/website-security-glossary/#certificate"
        }
      ]
    },
    {
      "type": "paragraph",
      "text": "Web basics · Basic #http-500",
      "links": [
        {
          "text": "#http-500",
          "url": "https://www.jkconcepts.at/en/website-security-glossary/#http-500"
        }
      ]
    },
    {
      "type": "heading",
      "level": 3,
      "text": "What does HTTP 500 mean?"
    },
    {
      "type": "paragraph",
      "text": "HTTP 500 · Internal Server Error"
    },
    {
      "type": "paragraph",
      "text": "The status code 500 reports an unexpected server-side error while processing a request."
    },
    {
      "type": "heading",
      "level": 3,
      "text": "Technology, example and context"
    },
    {
      "type": "heading",
      "level": 4,
      "text": "Technical explanation"
    },
    {
      "type": "paragraph",
      "text": "The public response is deliberately generic; specific causes are found in application and server logs and can range from code errors to resource problems."
    },
    {
      "type": "heading",
      "level": 4,
      "text": "Example"
    },
    {
      "type": "paragraph",
      "text": "A faulty plugin triggers an unhandled PHP exception."
    },
    {
      "type": "heading",
      "level": 4,
      "text": "Related terms"
    },
    {
      "type": "paragraph",
      "text": "Logging Monitoring Backend Web Server",
      "links": [
        {
          "text": "Logging",
          "url": "https://www.jkconcepts.at/en/website-security-glossary/#logging"
        },
        {
          "text": "Monitoring",
          "url": "https://www.jkconcepts.at/en/website-security-glossary/#monitoring"
        },
        {
          "text": "Backend",
          "url": "https://www.jkconcepts.at/en/website-security-glossary/#backend"
        },
        {
          "text": "Web Server",
          "url": "https://www.jkconcepts.at/en/website-security-glossary/#webserver"
        }
      ]
    },
    {
      "type": "paragraph",
      "text": "Is your website showing errors or down? See WordPress help →",
      "links": [
        {
          "text": "See WordPress help →",
          "url": "https://www.jkconcepts.at/en/wordpress-help/"
        }
      ]
    },
    {
      "type": "paragraph",
      "text": "Web basics · Advanced #http-header",
      "links": [
        {
          "text": "#http-header",
          "url": "https://www.jkconcepts.at/en/website-security-glossary/#http-header"
        }
      ]
    },
    {
      "type": "heading",
      "level": 3,
      "text": "What are HTTP headers?"
    },
    {
      "type": "paragraph",
      "text": "HTTP Header · Metadata of an HTTP message"
    },
    {
      "type": "paragraph",
      "text": "HTTP headers carry additional information about a request or response."
    },
    {
      "type": "heading",
      "level": 3,
      "text": "Technology, example and context"
    },
    {
      "type": "heading",
      "level": 4,
      "text": "Technical explanation"
    },
    {
      "type": "paragraph",
      "text": "Headers control, among other things, content type, caching, authentication, compression, cookies, CORS and browser security rules."
    },
    {
      "type": "heading",
      "level": 4,
      "text": "Example"
    },
    {
      "type": "paragraph",
      "text": "Content-Type: application/json marks a JSON response."
    },
    {
      "type": "heading",
      "level": 4,
      "text": "Related terms"
    },
    {
      "type": "paragraph",
      "text": "HTTP Cache-Control Security Headers CORS",
      "links": [
        {
          "text": "HTTP",
          "url": "https://www.jkconcepts.at/en/web-technology-glossary/#http"
        },
        {
          "text": "Cache-Control",
          "url": "https://www.jkconcepts.at/en/web-technology-glossary/#cache-control"
        },
        {
          "text": "Security Headers",
          "url": "https://www.jkconcepts.at/en/website-security-glossary/#security-headers"
        },
        {
          "text": "CORS",
          "url": "https://www.jkconcepts.at/en/website-security-glossary/#cors"
        }
      ]
    },
    {
      "type": "paragraph",
      "text": "Identity & access · Advanced #httponly",
      "links": [
        {
          "text": "#httponly",
          "url": "https://www.jkconcepts.at/en/website-security-glossary/#httponly"
        }
      ]
    },
    {
      "type": "heading",
      "level": 3,
      "text": "What does HttpOnly mean for cookies?"
    },
    {
      "type": "paragraph",
      "text": "HttpOnly · Cookie protection against JavaScript access"
    },
    {
      "type": "paragraph",
      "text": "HttpOnly prevents JavaScript in the browser from reading a cookie’s value directly."
    },
    {
      "type": "heading",
      "level": 3,
      "text": "Technology, example and context"
    },
    {
      "type": "heading",
      "level": 4,
      "text": "Technical explanation"
    },
    {
      "type": "paragraph",
      "text": "The browser still sends the cookie automatically with matching HTTP requests; CSRF protection and XSS prevention therefore remain necessary."
    },
    {
      "type": "heading",
      "level": 4,
      "text": "Example"
    },
    {
      "type": "paragraph",
      "text": "The session ID is not visible to document.cookie."
    },
    {
      "type": "heading",
      "level": 4,
      "text": "Related terms"
    },
    {
      "type": "paragraph",
      "text": "Cookie Session Hijacking Cross-Site Scripting Secure Cookie",
      "links": [
        {
          "text": "Cookie",
          "url": "https://www.jkconcepts.at/en/website-security-glossary/#cookie"
        },
        {
          "text": "Session Hijacking",
          "url": "https://www.jkconcepts.at/en/website-security-glossary/#session-hijacking"
        },
        {
          "text": "Cross-Site Scripting",
          "url": "https://www.jkconcepts.at/en/website-security-glossary/#xss"
        },
        {
          "text": "Secure Cookie",
          "url": "https://www.jkconcepts.at/en/website-security-glossary/#secure-cookie"
        }
      ]
    },
    {
      "type": "paragraph",
      "text": "Web basics · Basic #https",
      "links": [
        {
          "text": "#https",
          "url": "https://www.jkconcepts.at/en/website-security-glossary/#https"
        }
      ]
    },
    {
      "type": "heading",
      "level": 3,
      "text": "What is HTTPS?"
    },
    {
      "type": "paragraph",
      "text": "HTTPS · HTTP over TLS"
    },
    {
      "type": "paragraph",
      "text": "HTTPS uses TLS to protect the connection between client and server against simple eavesdropping and tampering."
    },
    {
      "type": "heading",
      "level": 3,
      "text": "Technology, example and context"
    },
    {
      "type": "heading",
      "level": 4,
      "text": "Technical explanation"
    },
    {
      "type": "paragraph",
      "text": "After the TLS handshake, HTTP messages are transmitted encrypted and authenticated; the certificate binds the public key to a host name."
    },
    {
      "type": "heading",
      "level": 4,
      "text": "Example"
    },
    {
      "type": "paragraph",
      "text": "A login form does not transmit credentials as unencrypted plain text over the network."
    },
    {
      "type": "heading",
      "level": 4,
      "text": "Why does it matter?"
    },
    {
      "type": "paragraph",
      "text": "HTTPS is a basic requirement for secure forms, modern browser features and trustworthy website operation."
    },
    {
      "type": "heading",
      "level": 4,
      "text": "Related terms"
    },
    {
      "type": "paragraph",
      "text": "TLS HTTP HSTS TLS Certificate",
      "links": [
        {
          "text": "TLS",
          "url": "https://www.jkconcepts.at/en/website-security-glossary/#tls"
        },
        {
          "text": "HTTP",
          "url": "https://www.jkconcepts.at/en/web-technology-glossary/#http"
        },
        {
          "text": "HSTS",
          "url": "https://www.jkconcepts.at/en/website-security-glossary/#hsts"
        },
        {
          "text": "TLS Certificate",
          "url": "https://www.jkconcepts.at/en/website-security-glossary/#certificate"
        }
      ]
    },
    {
      "type": "paragraph",
      "text": "Securing your website technically? See website security →",
      "links": [
        {
          "text": "See website security →",
          "url": "https://www.jkconcepts.at/en/wordpress-security/"
        }
      ]
    },
    {
      "type": "heading",
      "level": 2,
      "text": "Terms starting with I"
    },
    {
      "type": "paragraph",
      "text": "Attacks · Advanced #injection",
      "links": [
        {
          "text": "#injection",
          "url": "https://www.jkconcepts.at/en/website-security-glossary/#injection"
        }
      ]
    },
    {
      "type": "heading",
      "level": 3,
      "text": "What is an injection attack?"
    },
    {
      "type": "paragraph",
      "text": "Injection · Injecting commands or syntax"
    },
    {
      "type": "paragraph",
      "text": "In an injection, data is processed in such a way that it unintentionally acts as commands or program syntax."
    },
    {
      "type": "heading",
      "level": 3,
      "text": "Technology, example and context"
    },
    {
      "type": "heading",
      "level": 4,
      "text": "Technical explanation"
    },
    {
      "type": "paragraph",
      "text": "Secure APIs, context-aware encoding, parameterisation, strict separation of data and code and minimal permissions reduce the risk."
    },
    {
      "type": "heading",
      "level": 4,
      "text": "Example"
    },
    {
      "type": "paragraph",
      "text": "SQL, operating system or template syntax reaches an interpreter through unsecured input."
    },
    {
      "type": "heading",
      "level": 4,
      "text": "Related terms"
    },
    {
      "type": "paragraph",
      "text": "SQL Injection Cross-Site Scripting Remote Code Execution Input Validation",
      "links": [
        {
          "text": "SQL Injection",
          "url": "https://www.jkconcepts.at/en/website-security-glossary/#sql-injection"
        },
        {
          "text": "Cross-Site Scripting",
          "url": "https://www.jkconcepts.at/en/website-security-glossary/#xss"
        },
        {
          "text": "Remote Code Execution",
          "url": "https://www.jkconcepts.at/en/website-security-glossary/#rce"
        },
        {
          "text": "Input Validation",
          "url": "https://www.jkconcepts.at/en/website-security-glossary/#input-validation"
        }
      ]
    },
    {
      "type": "paragraph",
      "text": "Safeguards · Advanced #input-validation",
      "links": [
        {
          "text": "#input-validation",
          "url": "https://www.jkconcepts.at/en/website-security-glossary/#input-validation"
        }
      ]
    },
    {
      "type": "heading",
      "level": 3,
      "text": "What is input validation?"
    },
    {
      "type": "paragraph",
      "text": "Input Validation · Checking input data"
    },
    {
      "type": "paragraph",
      "text": "Input validation checks whether data matches the expected types, formats, lengths and business rules."
    },
    {
      "type": "heading",
      "level": 3,
      "text": "Technology, example and context"
    },
    {
      "type": "heading",
      "level": 4,
      "text": "Technical explanation"
    },
    {
      "type": "paragraph",
      "text": "The decisive check happens at the trust boundary on the server; it does not replace context-specific encoding or parameterised APIs."
    },
    {
      "type": "heading",
      "level": 4,
      "text": "Example"
    },
    {
      "type": "paragraph",
      "text": "An ID must be a positive integer and refer to a record the user is authorised to access."
    },
    {
      "type": "heading",
      "level": 4,
      "text": "Related terms"
    },
    {
      "type": "paragraph",
      "text": "Injection SQL Injection Cross-Site Scripting Authorisation",
      "links": [
        {
          "text": "Injection",
          "url": "https://www.jkconcepts.at/en/website-security-glossary/#injection"
        },
        {
          "text": "SQL Injection",
          "url": "https://www.jkconcepts.at/en/website-security-glossary/#sql-injection"
        },
        {
          "text": "Cross-Site Scripting",
          "url": "https://www.jkconcepts.at/en/website-security-glossary/#xss"
        },
        {
          "text": "Authorisation",
          "url": "https://www.jkconcepts.at/en/website-security-glossary/#authorization"
        }
      ]
    },
    {
      "type": "paragraph",
      "text": "Safeguards · Basic #ip-blocking",
      "links": [
        {
          "text": "#ip-blocking",
          "url": "https://www.jkconcepts.at/en/website-security-glossary/#ip-blocking"
        }
      ]
    },
    {
      "type": "heading",
      "level": 3,
      "text": "What does IP blocking mean?"
    },
    {
      "type": "paragraph",
      "text": "IP Blocking · Blocking network addresses"
    },
    {
      "type": "paragraph",
      "text": "IP blocking refuses requests from selected IP addresses or networks."
    },
    {
      "type": "heading",
      "level": 3,
      "text": "Technology, example and context"
    },
    {
      "type": "heading",
      "level": 4,
      "text": "Technical explanation"
    },
    {
      "type": "paragraph",
      "text": "The measure is coarse because addresses can be shared, dynamic or changed via proxies; it should be part of multi-layered detection."
    },
    {
      "type": "heading",
      "level": 4,
      "text": "Example"
    },
    {
      "type": "paragraph",
      "text": "A clearly abusive host is temporarily blocked at the web server."
    },
    {
      "type": "heading",
      "level": 4,
      "text": "Related terms"
    },
    {
      "type": "paragraph",
      "text": "Firewall Bot Protection Rate Limiting",
      "links": [
        {
          "text": "Firewall",
          "url": "https://www.jkconcepts.at/en/website-security-glossary/#firewall"
        },
        {
          "text": "Bot Protection",
          "url": "https://www.jkconcepts.at/en/website-security-glossary/#bot-protection"
        },
        {
          "text": "Rate Limiting",
          "url": "https://www.jkconcepts.at/en/website-security-glossary/#rate-limiting"
        }
      ]
    },
    {
      "type": "heading",
      "level": 2,
      "text": "Terms starting with L"
    },
    {
      "type": "paragraph",
      "text": "Identity & access · Basic #least-privilege",
      "links": [
        {
          "text": "#least-privilege",
          "url": "https://www.jkconcepts.at/en/website-security-glossary/#least-privilege"
        }
      ]
    },
    {
      "type": "heading",
      "level": 3,
      "text": "What does least privilege mean?"
    },
    {
      "type": "paragraph",
      "text": "Least Privilege · Principle of minimal permissions"
    },
    {
      "type": "paragraph",
      "text": "Least privilege grants only the permissions that are actually needed for a specific task."
    },
    {
      "type": "heading",
      "level": 3,
      "text": "Technology, example and context"
    },
    {
      "type": "heading",
      "level": 4,
      "text": "Technical explanation"
    },
    {
      "type": "paragraph",
      "text": "The principle applies to users, processes, databases, API tokens and networks and limits the impact of compromised components."
    },
    {
      "type": "heading",
      "level": 4,
      "text": "Example"
    },
    {
      "type": "paragraph",
      "text": "The website connects to a database account without global administrator rights."
    },
    {
      "type": "heading",
      "level": 4,
      "text": "Related terms"
    },
    {
      "type": "paragraph",
      "text": "Authorisation Zero Trust Privilege Escalation API",
      "links": [
        {
          "text": "Authorisation",
          "url": "https://www.jkconcepts.at/en/website-security-glossary/#authorization"
        },
        {
          "text": "Zero Trust",
          "url": "https://www.jkconcepts.at/en/website-security-glossary/#zero-trust"
        },
        {
          "text": "Privilege Escalation",
          "url": "https://www.jkconcepts.at/en/website-security-glossary/#privilege-escalation"
        },
        {
          "text": "API",
          "url": "https://www.jkconcepts.at/en/web-technology-glossary/#api"
        }
      ]
    },
    {
      "type": "paragraph",
      "text": "Operations & detection · Basic #logging",
      "links": [
        {
          "text": "#logging",
          "url": "https://www.jkconcepts.at/en/website-security-glossary/#logging"
        }
      ]
    },
    {
      "type": "heading",
      "level": 3,
      "text": "What does logging mean?"
    },
    {
      "type": "paragraph",
      "text": "Logging · Recording events"
    },
    {
      "type": "paragraph",
      "text": "Logging records technical and security-relevant events for diagnosis, traceability and detection."
    },
    {
      "type": "heading",
      "level": 3,
      "text": "Technology, example and context"
    },
    {
      "type": "heading",
      "level": 4,
      "text": "Technical explanation"
    },
    {
      "type": "paragraph",
      "text": "Good logs contain the time, event type and necessary context, avoid sensitive content and are protected against unnoticed tampering."
    },
    {
      "type": "heading",
      "level": 4,
      "text": "Example"
    },
    {
      "type": "paragraph",
      "text": "Failed logins are logged with the account, time and approximate origin."
    },
    {
      "type": "heading",
      "level": 4,
      "text": "Related terms"
    },
    {
      "type": "paragraph",
      "text": "Monitoring HTTP 500 File Integrity Monitoring Website Security",
      "links": [
        {
          "text": "Monitoring",
          "url": "https://www.jkconcepts.at/en/website-security-glossary/#monitoring"
        },
        {
          "text": "HTTP 500",
          "url": "https://www.jkconcepts.at/en/website-security-glossary/#http-500"
        },
        {
          "text": "File Integrity Monitoring",
          "url": "https://www.jkconcepts.at/en/website-security-glossary/#file-integrity-monitoring"
        },
        {
          "text": "Website Security",
          "url": "https://www.jkconcepts.at/en/website-security-glossary/#website-security"
        }
      ]
    },
    {
      "type": "heading",
      "level": 2,
      "text": "Terms starting with M"
    },
    {
      "type": "paragraph",
      "text": "Basics · Basic #malware",
      "links": [
        {
          "text": "#malware",
          "url": "https://www.jkconcepts.at/en/website-security-glossary/#malware"
        }
      ]
    },
    {
      "type": "heading",
      "level": 3,
      "text": "What is malware?"
    },
    {
      "type": "paragraph",
      "text": "Malware · Malicious software"
    },
    {
      "type": "paragraph",
      "text": "Malware is software or injected code with a malicious or unauthorised function."
    },
    {
      "type": "heading",
      "level": 3,
      "text": "Technology, example and context"
    },
    {
      "type": "heading",
      "level": 4,
      "text": "Technical explanation"
    },
    {
      "type": "paragraph",
      "text": "On websites, malware modifies files or databases, creates access, redirects visitors, sends spam or loads further components."
    },
    {
      "type": "heading",
      "level": 4,
      "text": "Example"
    },
    {
      "type": "paragraph",
      "text": "A compromised plugin injects a script that redirects visitors to fraudulent sites."
    },
    {
      "type": "heading",
      "level": 4,
      "text": "Why does it matter?"
    },
    {
      "type": "paragraph",
      "text": "A clean-up has to deal not only with visible files, but also with the entry point, persistence and compromised credentials."
    },
    {
      "type": "heading",
      "level": 4,
      "text": "Related terms"
    },
    {
      "type": "paragraph",
      "text": "Backdoor Malware Scanning File Integrity Monitoring Website Security",
      "links": [
        {
          "text": "Backdoor",
          "url": "https://www.jkconcepts.at/en/website-security-glossary/#backdoor"
        },
        {
          "text": "Malware Scanning",
          "url": "https://www.jkconcepts.at/en/website-security-glossary/#malware-scanning"
        },
        {
          "text": "File Integrity Monitoring",
          "url": "https://www.jkconcepts.at/en/website-security-glossary/#file-integrity-monitoring"
        },
        {
          "text": "Website Security",
          "url": "https://www.jkconcepts.at/en/website-security-glossary/#website-security"
        }
      ]
    },
    {
      "type": "paragraph",
      "text": "Suspect your website is infected? See immediate steps →",
      "links": [
        {
          "text": "See immediate steps →",
          "url": "https://www.jkconcepts.at/en/wordpress-hacked/"
        }
      ]
    },
    {
      "type": "paragraph",
      "text": "Operations & detection · Basic #malware-scanning",
      "links": [
        {
          "text": "#malware-scanning",
          "url": "https://www.jkconcepts.at/en/website-security-glossary/#malware-scanning"
        }
      ]
    },
    {
      "type": "heading",
      "level": 3,
      "text": "What is malware scanning?"
    },
    {
      "type": "paragraph",
      "text": "Malware Scanning · Automated search for malicious code"
    },
    {
      "type": "paragraph",
      "text": "Malware scanning examines files, content or behaviour for signs of malicious code."
    },
    {
      "type": "heading",
      "level": 3,
      "text": "Technology, example and context"
    },
    {
      "type": "heading",
      "level": 4,
      "text": "Technical explanation"
    },
    {
      "type": "paragraph",
      "text": "Signatures, heuristics, reputation data and file comparisons complement each other; no single scan proves that a system is clean."
    },
    {
      "type": "heading",
      "level": 4,
      "text": "Example"
    },
    {
      "type": "paragraph",
      "text": "A scanner finds a known web shell signature in a modified plugin file."
    },
    {
      "type": "heading",
      "level": 4,
      "text": "Related terms"
    },
    {
      "type": "paragraph",
      "text": "Malware Backdoor File Integrity Monitoring Monitoring",
      "links": [
        {
          "text": "Malware",
          "url": "https://www.jkconcepts.at/en/website-security-glossary/#malware"
        },
        {
          "text": "Backdoor",
          "url": "https://www.jkconcepts.at/en/website-security-glossary/#backdoor"
        },
        {
          "text": "File Integrity Monitoring",
          "url": "https://www.jkconcepts.at/en/website-security-glossary/#file-integrity-monitoring"
        },
        {
          "text": "Monitoring",
          "url": "https://www.jkconcepts.at/en/website-security-glossary/#monitoring"
        }
      ]
    },
    {
      "type": "paragraph",
      "text": "Suspect your website is infected? See immediate steps →",
      "links": [
        {
          "text": "See immediate steps →",
          "url": "https://www.jkconcepts.at/en/wordpress-hacked/"
        }
      ]
    },
    {
      "type": "paragraph",
      "text": "Identity & access · Basic #mfa",
      "links": [
        {
          "text": "#mfa",
          "url": "https://www.jkconcepts.at/en/website-security-glossary/#mfa"
        }
      ]
    },
    {
      "type": "heading",
      "level": 3,
      "text": "What is MFA?"
    },
    {
      "type": "paragraph",
      "text": "MFA / 2FA · Multi-factor authentication"
    },
    {
      "type": "paragraph",
      "text": "MFA requires several independent proofs for a login."
    },
    {
      "type": "heading",
      "level": 3,
      "text": "Technology, example and context"
    },
    {
      "type": "heading",
      "level": 4,
      "text": "Technical explanation"
    },
    {
      "type": "paragraph",
      "text": "Factors typically come from knowledge, possession or inherence; phishing-resistant methods such as WebAuthn are stronger than transferable one-time codes."
    },
    {
      "type": "heading",
      "level": 4,
      "text": "Example"
    },
    {
      "type": "paragraph",
      "text": "In addition to the password, an administrator confirms the login with a security key."
    },
    {
      "type": "heading",
      "level": 4,
      "text": "Related terms"
    },
    {
      "type": "paragraph",
      "text": "Authentication TOTP Passkey WebAuthn",
      "links": [
        {
          "text": "Authentication",
          "url": "https://www.jkconcepts.at/en/website-security-glossary/#authentication"
        },
        {
          "text": "TOTP",
          "url": "https://www.jkconcepts.at/en/website-security-glossary/#totp"
        },
        {
          "text": "Passkey",
          "url": "https://www.jkconcepts.at/en/website-security-glossary/#passkey"
        },
        {
          "text": "WebAuthn",
          "url": "https://www.jkconcepts.at/en/website-security-glossary/#webauthn"
        }
      ]
    },
    {
      "type": "paragraph",
      "text": "Operations & detection · Basic #monitoring",
      "links": [
        {
          "text": "#monitoring",
          "url": "https://www.jkconcepts.at/en/website-security-glossary/#monitoring"
        }
      ]
    },
    {
      "type": "heading",
      "level": 3,
      "text": "What is website monitoring?"
    },
    {
      "type": "paragraph",
      "text": "Monitoring · Ongoing system monitoring"
    },
    {
      "type": "paragraph",
      "text": "Monitoring observes the availability, performance, errors and selected security signals of a system."
    },
    {
      "type": "heading",
      "level": 3,
      "text": "Technology, example and context"
    },
    {
      "type": "heading",
      "level": 4,
      "text": "Technical explanation"
    },
    {
      "type": "paragraph",
      "text": "Metrics, synthetic checks and log signals need thresholds, alerting paths and responsible responses so that data turns into action."
    },
    {
      "type": "heading",
      "level": 4,
      "text": "Example"
    },
    {
      "type": "paragraph",
      "text": "An alert is triggered when the website cannot be reached or errors rise sharply."
    },
    {
      "type": "heading",
      "level": 4,
      "text": "Related terms"
    },
    {
      "type": "paragraph",
      "text": "Logging Backup File Integrity Monitoring Disaster Recovery",
      "links": [
        {
          "text": "Logging",
          "url": "https://www.jkconcepts.at/en/website-security-glossary/#logging"
        },
        {
          "text": "Backup",
          "url": "https://www.jkconcepts.at/en/website-security-glossary/#backup"
        },
        {
          "text": "File Integrity Monitoring",
          "url": "https://www.jkconcepts.at/en/website-security-glossary/#file-integrity-monitoring"
        },
        {
          "text": "Disaster Recovery",
          "url": "https://www.jkconcepts.at/en/website-security-glossary/#disaster-recovery"
        }
      ]
    },
    {
      "type": "paragraph",
      "text": "Ongoing care for updates, backups and monitoring? See WordPress maintenance →",
      "links": [
        {
          "text": "See WordPress maintenance →",
          "url": "https://www.jkconcepts.at/en/wordpress-maintenance/"
        }
      ]
    },
    {
      "type": "heading",
      "level": 2,
      "text": "Terms starting with P"
    },
    {
      "type": "paragraph",
      "text": "Identity & access · Basic #passkey",
      "links": [
        {
          "text": "#passkey",
          "url": "https://www.jkconcepts.at/en/website-security-glossary/#passkey"
        }
      ]
    },
    {
      "type": "heading",
      "level": 3,
      "text": "What is a passkey?"
    },
    {
      "type": "paragraph",
      "text": "Passkey · Phishing-resistant login with a key pair"
    },
    {
      "type": "paragraph",
      "text": "A passkey logs a user in with a cryptographic key pair instead of a shared password."
    },
    {
      "type": "heading",
      "level": 3,
      "text": "Technology, example and context"
    },
    {
      "type": "heading",
      "level": 4,
      "text": "Technical explanation"
    },
    {
      "type": "paragraph",
      "text": "The private key stays on the device or in a protected sync system; the server only stores the public key and a credential ID."
    },
    {
      "type": "heading",
      "level": 4,
      "text": "Example"
    },
    {
      "type": "paragraph",
      "text": "A login is confirmed with the device PIN or biometrics without sending a password to the website."
    },
    {
      "type": "heading",
      "level": 4,
      "text": "Related terms"
    },
    {
      "type": "paragraph",
      "text": "WebAuthn Authentication MFA / 2FA Phishing",
      "links": [
        {
          "text": "WebAuthn",
          "url": "https://www.jkconcepts.at/en/website-security-glossary/#webauthn"
        },
        {
          "text": "Authentication",
          "url": "https://www.jkconcepts.at/en/website-security-glossary/#authentication"
        },
        {
          "text": "MFA / 2FA",
          "url": "https://www.jkconcepts.at/en/website-security-glossary/#mfa"
        },
        {
          "text": "Phishing",
          "url": "https://www.jkconcepts.at/en/website-security-glossary/#phishing"
        }
      ]
    },
    {
      "type": "paragraph",
      "text": "Attacks · Technical #path-traversal",
      "links": [
        {
          "text": "#path-traversal",
          "url": "https://www.jkconcepts.at/en/website-security-glossary/#path-traversal"
        }
      ]
    },
    {
      "type": "heading",
      "level": 3,
      "text": "What is path traversal?"
    },
    {
      "type": "paragraph",
      "text": "Path Traversal · Unauthorised file path access"
    },
    {
      "type": "paragraph",
      "text": "Path traversal manipulates file paths in order to access files outside a permitted directory."
    },
    {
      "type": "heading",
      "level": 3,
      "text": "Technology, example and context"
    },
    {
      "type": "heading",
      "level": 4,
      "text": "Technical explanation"
    },
    {
      "type": "paragraph",
      "text": "Applications should not use user input directly as paths, should check canonical targets and limit file access to defined roots."
    },
    {
      "type": "heading",
      "level": 4,
      "text": "Example"
    },
    {
      "type": "paragraph",
      "text": "A download function accepts../ sequences and delivers a configuration file."
    },
    {
      "type": "heading",
      "level": 4,
      "text": "Related terms"
    },
    {
      "type": "paragraph",
      "text": "File Inclusion Input Validation Least Privilege",
      "links": [
        {
          "text": "File Inclusion",
          "url": "https://www.jkconcepts.at/en/website-security-glossary/#file-inclusion"
        },
        {
          "text": "Input Validation",
          "url": "https://www.jkconcepts.at/en/website-security-glossary/#input-validation"
        },
        {
          "text": "Least Privilege",
          "url": "https://www.jkconcepts.at/en/website-security-glossary/#least-privilege"
        }
      ]
    },
    {
      "type": "paragraph",
      "text": "Basics · Basic #phishing",
      "links": [
        {
          "text": "#phishing",
          "url": "https://www.jkconcepts.at/en/website-security-glossary/#phishing"
        }
      ]
    },
    {
      "type": "heading",
      "level": 3,
      "text": "What is phishing?"
    },
    {
      "type": "paragraph",
      "text": "Phishing · Deception to obtain sensitive information"
    },
    {
      "type": "paragraph",
      "text": "Phishing fakes trustworthy communication in order to obtain credentials, payments or other sensitive actions."
    },
    {
      "type": "heading",
      "level": 3,
      "text": "Technology, example and context"
    },
    {
      "type": "heading",
      "level": 4,
      "text": "Technical explanation"
    },
    {
      "type": "paragraph",
      "text": "Attackers combine social engineering with cloned login pages, prepared attachments, OAuth grants or fraudulent payment instructions."
    },
    {
      "type": "heading",
      "level": 4,
      "text": "Example"
    },
    {
      "type": "paragraph",
      "text": "A fake hosting message asks you to log in on a domain with a similar spelling."
    },
    {
      "type": "heading",
      "level": 4,
      "text": "Related terms"
    },
    {
      "type": "paragraph",
      "text": "Social Engineering Credential Stuffing MFA / 2FA Passkey",
      "links": [
        {
          "text": "Social Engineering",
          "url": "https://www.jkconcepts.at/en/website-security-glossary/#social-engineering"
        },
        {
          "text": "Credential Stuffing",
          "url": "https://www.jkconcepts.at/en/website-security-glossary/#credential-stuffing"
        },
        {
          "text": "MFA / 2FA",
          "url": "https://www.jkconcepts.at/en/website-security-glossary/#mfa"
        },
        {
          "text": "Passkey",
          "url": "https://www.jkconcepts.at/en/website-security-glossary/#passkey"
        }
      ]
    },
    {
      "type": "paragraph",
      "text": "WordPress security · Basic #plugin-vulnerability",
      "links": [
        {
          "text": "#plugin-vulnerability",
          "url": "https://www.jkconcepts.at/en/website-security-glossary/#plugin-vulnerability"
        }
      ]
    },
    {
      "type": "heading",
      "level": 3,
      "text": "What is a plugin vulnerability?"
    },
    {
      "type": "paragraph",
      "text": "Plugin Vulnerability · Weakness in an extension"
    },
    {
      "type": "paragraph",
      "text": "A plugin vulnerability is an exploitable weakness in an extension or its configuration."
    },
    {
      "type": "heading",
      "level": 3,
      "text": "Technology, example and context"
    },
    {
      "type": "heading",
      "level": 4,
      "text": "Technical explanation"
    },
    {
      "type": "paragraph",
      "text": "The risk depends on reachability, required permissions, active use, available exploits and possible impact."
    },
    {
      "type": "heading",
      "level": 4,
      "text": "Example"
    },
    {
      "type": "paragraph",
      "text": "An upload function does not check the file type and permissions sufficiently."
    },
    {
      "type": "heading",
      "level": 4,
      "text": "Related terms"
    },
    {
      "type": "paragraph",
      "text": "Vulnerability Security Patch WordPress Hardening Software Supply Chain Attack",
      "links": [
        {
          "text": "Vulnerability",
          "url": "https://www.jkconcepts.at/en/website-security-glossary/#vulnerability"
        },
        {
          "text": "Security Patch",
          "url": "https://www.jkconcepts.at/en/website-security-glossary/#patch"
        },
        {
          "text": "WordPress Hardening",
          "url": "https://www.jkconcepts.at/en/website-security-glossary/#wordpress-hardening"
        },
        {
          "text": "Software Supply Chain Attack",
          "url": "https://www.jkconcepts.at/en/website-security-glossary/#supply-chain-attack"
        }
      ]
    },
    {
      "type": "paragraph",
      "text": "Ongoing care for updates, backups and monitoring? See WordPress maintenance →",
      "links": [
        {
          "text": "See WordPress maintenance →",
          "url": "https://www.jkconcepts.at/en/wordpress-maintenance/"
        }
      ]
    },
    {
      "type": "paragraph",
      "text": "Attacks · Advanced #privilege-escalation",
      "links": [
        {
          "text": "#privilege-escalation",
          "url": "https://www.jkconcepts.at/en/website-security-glossary/#privilege-escalation"
        }
      ]
    },
    {
      "type": "heading",
      "level": 3,
      "text": "What is privilege escalation?"
    },
    {
      "type": "paragraph",
      "text": "Privilege Escalation · Gaining more permissions"
    },
    {
      "type": "paragraph",
      "text": "Privilege escalation gives a user or process more permissions than intended."
    },
    {
      "type": "heading",
      "level": 3,
      "text": "Technology, example and context"
    },
    {
      "type": "heading",
      "level": 4,
      "text": "Technical explanation"
    },
    {
      "type": "paragraph",
      "text": "Vertical escalation reaches higher roles, horizontal escalation accesses other people’s resources at the same level; server-side authorisation is decisive."
    },
    {
      "type": "heading",
      "level": 4,
      "text": "Example"
    },
    {
      "type": "paragraph",
      "text": "A normal user changes a URL and reaches an action intended only for administrators."
    },
    {
      "type": "heading",
      "level": 4,
      "text": "Related terms"
    },
    {
      "type": "paragraph",
      "text": "Authorisation Least Privilege Vulnerability Remote Code Execution",
      "links": [
        {
          "text": "Authorisation",
          "url": "https://www.jkconcepts.at/en/website-security-glossary/#authorization"
        },
        {
          "text": "Least Privilege",
          "url": "https://www.jkconcepts.at/en/website-security-glossary/#least-privilege"
        },
        {
          "text": "Vulnerability",
          "url": "https://www.jkconcepts.at/en/website-security-glossary/#vulnerability"
        },
        {
          "text": "Remote Code Execution",
          "url": "https://www.jkconcepts.at/en/website-security-glossary/#rce"
        }
      ]
    },
    {
      "type": "paragraph",
      "text": "AI security · Advanced #prompt-injection",
      "links": [
        {
          "text": "#prompt-injection",
          "url": "https://www.jkconcepts.at/en/website-security-glossary/#prompt-injection"
        }
      ]
    },
    {
      "type": "heading",
      "level": 3,
      "text": "What does Prompt Injection mean?"
    },
    {
      "type": "paragraph",
      "text": "Prompt Injection · Manipulation through injected instructions"
    },
    {
      "type": "paragraph",
      "text": "An attack in which malicious instructions in inputs or in content that is read are meant to manipulate the AI system."
    },
    {
      "type": "heading",
      "level": 3,
      "text": "Technology, example and context"
    },
    {
      "type": "heading",
      "level": 4,
      "text": "Example"
    },
    {
      "type": "paragraph",
      "text": "A document contains hidden instructions intended to make an agent reveal data or call a tool."
    },
    {
      "type": "heading",
      "level": 4,
      "text": "Why does it matter?"
    },
    {
      "type": "paragraph",
      "text": "As soon as models read external content or use tools, system prompts are not enough; permissions and actions must be limited technically."
    },
    {
      "type": "heading",
      "level": 4,
      "text": "Related terms"
    },
    {
      "type": "paragraph",
      "text": "Jailbreak System Prompt AI Guardrails",
      "links": [
        {
          "text": "Jailbreak",
          "url": "https://www.jkconcepts.at/en/ai-glossary/#jailbreak"
        },
        {
          "text": "System Prompt",
          "url": "https://www.jkconcepts.at/en/ai-glossary/#system-prompt"
        },
        {
          "text": "AI Guardrails",
          "url": "https://www.jkconcepts.at/en/website-security-glossary/#ai-guardrails"
        }
      ]
    },
    {
      "type": "heading",
      "level": 2,
      "text": "Terms starting with R"
    },
    {
      "type": "paragraph",
      "text": "Basics · Basic #ransomware",
      "links": [
        {
          "text": "#ransomware",
          "url": "https://www.jkconcepts.at/en/website-security-glossary/#ransomware"
        }
      ]
    },
    {
      "type": "heading",
      "level": 3,
      "text": "What is ransomware?"
    },
    {
      "type": "paragraph",
      "text": "Ransomware · Extortion software"
    },
    {
      "type": "paragraph",
      "text": "Ransomware encrypts or withholds data and systems in order to extort a payment."
    },
    {
      "type": "heading",
      "level": 3,
      "text": "Technology, example and context"
    },
    {
      "type": "heading",
      "level": 4,
      "text": "Technical explanation"
    },
    {
      "type": "paragraph",
      "text": "Attacks often combine credential theft, lateral movement, data exfiltration and targeted sabotage of backups."
    },
    {
      "type": "heading",
      "level": 4,
      "text": "Example"
    },
    {
      "type": "paragraph",
      "text": "A compromised administrator account is used to encrypt server data and any backups that can be reached."
    },
    {
      "type": "heading",
      "level": 4,
      "text": "Related terms"
    },
    {
      "type": "paragraph",
      "text": "Malware Phishing Backup Disaster Recovery",
      "links": [
        {
          "text": "Malware",
          "url": "https://www.jkconcepts.at/en/website-security-glossary/#malware"
        },
        {
          "text": "Phishing",
          "url": "https://www.jkconcepts.at/en/website-security-glossary/#phishing"
        },
        {
          "text": "Backup",
          "url": "https://www.jkconcepts.at/en/website-security-glossary/#backup"
        },
        {
          "text": "Disaster Recovery",
          "url": "https://www.jkconcepts.at/en/website-security-glossary/#disaster-recovery"
        }
      ]
    },
    {
      "type": "paragraph",
      "text": "Safeguards · Advanced #rate-limiting",
      "links": [
        {
          "text": "#rate-limiting",
          "url": "https://www.jkconcepts.at/en/website-security-glossary/#rate-limiting"
        }
      ]
    },
    {
      "type": "heading",
      "level": 3,
      "text": "What is rate limiting?"
    },
    {
      "type": "paragraph",
      "text": "Rate Limiting · Limiting requests"
    },
    {
      "type": "paragraph",
      "text": "Rate limiting restricts how many actions are allowed within a period of time."
    },
    {
      "type": "heading",
      "level": 3,
      "text": "Technology, example and context"
    },
    {
      "type": "heading",
      "level": 4,
      "text": "Technical explanation"
    },
    {
      "type": "paragraph",
      "text": "Limits can apply per account, token, IP, route or risk signal; distributed systems need a shared or consistent counter."
    },
    {
      "type": "heading",
      "level": 4,
      "text": "Example"
    },
    {
      "type": "paragraph",
      "text": "After several failed logins, further attempts are delayed step by step."
    },
    {
      "type": "heading",
      "level": 4,
      "text": "Related terms"
    },
    {
      "type": "paragraph",
      "text": "Brute Force Bot Protection API DDoS",
      "links": [
        {
          "text": "Brute Force",
          "url": "https://www.jkconcepts.at/en/website-security-glossary/#brute-force"
        },
        {
          "text": "Bot Protection",
          "url": "https://www.jkconcepts.at/en/website-security-glossary/#bot-protection"
        },
        {
          "text": "API",
          "url": "https://www.jkconcepts.at/en/web-technology-glossary/#api"
        },
        {
          "text": "DDoS",
          "url": "https://www.jkconcepts.at/en/website-security-glossary/#ddos"
        }
      ]
    },
    {
      "type": "paragraph",
      "text": "Attacks · Technical #rce",
      "links": [
        {
          "text": "#rce",
          "url": "https://www.jkconcepts.at/en/website-security-glossary/#rce"
        }
      ]
    },
    {
      "type": "heading",
      "level": 3,
      "text": "What is remote code execution?"
    },
    {
      "type": "paragraph",
      "text": "Remote Code Execution · RCE"
    },
    {
      "type": "paragraph",
      "text": "Remote code execution makes it possible to run an attacker’s code on a remote system."
    },
    {
      "type": "heading",
      "level": 3,
      "text": "Technology, example and context"
    },
    {
      "type": "heading",
      "level": 4,
      "text": "Technical explanation"
    },
    {
      "type": "paragraph",
      "text": "RCE can arise from injection, insecure deserialisation, file uploads, memory corruption or compromised dependencies and usually has a high impact."
    },
    {
      "type": "heading",
      "level": 4,
      "text": "Example"
    },
    {
      "type": "paragraph",
      "text": "A vulnerable extension executes an injected system command with the web server’s permissions."
    },
    {
      "type": "heading",
      "level": 4,
      "text": "Related terms"
    },
    {
      "type": "paragraph",
      "text": "Exploit Injection File Inclusion Least Privilege",
      "links": [
        {
          "text": "Exploit",
          "url": "https://www.jkconcepts.at/en/website-security-glossary/#exploit"
        },
        {
          "text": "Injection",
          "url": "https://www.jkconcepts.at/en/website-security-glossary/#injection"
        },
        {
          "text": "File Inclusion",
          "url": "https://www.jkconcepts.at/en/website-security-glossary/#file-inclusion"
        },
        {
          "text": "Least Privilege",
          "url": "https://www.jkconcepts.at/en/website-security-glossary/#least-privilege"
        }
      ]
    },
    {
      "type": "paragraph",
      "text": "Web basics · Basic #robots-txt",
      "links": [
        {
          "text": "#robots-txt",
          "url": "https://www.jkconcepts.at/en/website-security-glossary/#robots-txt"
        }
      ]
    },
    {
      "type": "heading",
      "level": 3,
      "text": "What is robots.txt?"
    },
    {
      "type": "paragraph",
      "text": "robots.txt · Crawler control file"
    },
    {
      "type": "paragraph",
      "text": "robots.txt gives cooperating crawlers rules for fetching certain areas of a website."
    },
    {
      "type": "heading",
      "level": 3,
      "text": "Technology, example and context"
    },
    {
      "type": "heading",
      "level": 4,
      "text": "Technical explanation"
    },
    {
      "type": "paragraph",
      "text": "The file lives at the origin under /robots.txt; Disallow does not prevent access and is no reliable protection against indexing or attackers."
    },
    {
      "type": "heading",
      "level": 4,
      "text": "Example"
    },
    {
      "type": "paragraph",
      "text": "Internal search results are excluded from crawling by search engine bots."
    },
    {
      "type": "heading",
      "level": 4,
      "text": "Related terms"
    },
    {
      "type": "paragraph",
      "text": "XML Sitemap Crawler & AI Crawler Canonical URL",
      "links": [
        {
          "text": "XML Sitemap",
          "url": "https://www.jkconcepts.at/en/web-technology-glossary/#sitemap"
        },
        {
          "text": "Crawler & AI Crawler",
          "url": "https://www.jkconcepts.at/en/ai-glossary/#ai-crawler"
        },
        {
          "text": "Canonical URL",
          "url": "https://www.jkconcepts.at/en/web-technology-glossary/#canonical-url"
        }
      ]
    },
    {
      "type": "heading",
      "level": 2,
      "text": "Terms starting with S"
    },
    {
      "type": "paragraph",
      "text": "Identity & access · Technical #samesite-cookie",
      "links": [
        {
          "text": "#samesite-cookie",
          "url": "https://www.jkconcepts.at/en/website-security-glossary/#samesite-cookie"
        }
      ]
    },
    {
      "type": "heading",
      "level": 3,
      "text": "What does SameSite mean for cookies?"
    },
    {
      "type": "paragraph",
      "text": "SameSite Cookie · Limiting cross-site cookie transmission"
    },
    {
      "type": "paragraph",
      "text": "SameSite controls when a browser sends cookies with requests from a different site context."
    },
    {
      "type": "heading",
      "level": 3,
      "text": "Technology, example and context"
    },
    {
      "type": "heading",
      "level": 4,
      "text": "Technical explanation"
    },
    {
      "type": "paragraph",
      "text": "Strict, Lax and None have different rules for navigation and embedding; SameSite=None requires Secure."
    },
    {
      "type": "heading",
      "level": 4,
      "text": "Example"
    },
    {
      "type": "paragraph",
      "text": "A Lax session cookie reduces many simple CSRF scenarios without preventing normal link navigation."
    },
    {
      "type": "heading",
      "level": 4,
      "text": "Related terms"
    },
    {
      "type": "paragraph",
      "text": "Cookie CSRF Secure Cookie HttpOnly",
      "links": [
        {
          "text": "Cookie",
          "url": "https://www.jkconcepts.at/en/website-security-glossary/#cookie"
        },
        {
          "text": "CSRF",
          "url": "https://www.jkconcepts.at/en/website-security-glossary/#csrf"
        },
        {
          "text": "Secure Cookie",
          "url": "https://www.jkconcepts.at/en/website-security-glossary/#secure-cookie"
        },
        {
          "text": "HttpOnly",
          "url": "https://www.jkconcepts.at/en/website-security-glossary/#httponly"
        }
      ]
    },
    {
      "type": "paragraph",
      "text": "Identity & access · Advanced #secure-cookie",
      "links": [
        {
          "text": "#secure-cookie",
          "url": "https://www.jkconcepts.at/en/website-security-glossary/#secure-cookie"
        }
      ]
    },
    {
      "type": "heading",
      "level": 3,
      "text": "What does Secure mean for cookies?"
    },
    {
      "type": "paragraph",
      "text": "Secure Cookie · Cookie sent only over HTTPS"
    },
    {
      "type": "paragraph",
      "text": "The Secure attribute ensures that a cookie is only sent over encrypted HTTPS connections."
    },
    {
      "type": "heading",
      "level": 3,
      "text": "Technology, example and context"
    },
    {
      "type": "heading",
      "level": 4,
      "text": "Technical explanation"
    },
    {
      "type": "paragraph",
      "text": "It doesn’t protect against client-side reading and should be combined for sensitive cookies with HttpOnly, SameSite and narrow domain and path limits."
    },
    {
      "type": "heading",
      "level": 4,
      "text": "Example"
    },
    {
      "type": "paragraph",
      "text": "A session cookie is never transmitted over an unencrypted HTTP connection."
    },
    {
      "type": "heading",
      "level": 4,
      "text": "Related terms"
    },
    {
      "type": "paragraph",
      "text": "Cookie HTTPS HttpOnly SameSite Cookie",
      "links": [
        {
          "text": "Cookie",
          "url": "https://www.jkconcepts.at/en/website-security-glossary/#cookie"
        },
        {
          "text": "HTTPS",
          "url": "https://www.jkconcepts.at/en/website-security-glossary/#https"
        },
        {
          "text": "HttpOnly",
          "url": "https://www.jkconcepts.at/en/website-security-glossary/#httponly"
        },
        {
          "text": "SameSite Cookie",
          "url": "https://www.jkconcepts.at/en/website-security-glossary/#samesite-cookie"
        }
      ]
    },
    {
      "type": "paragraph",
      "text": "Safeguards · Advanced #security-headers",
      "links": [
        {
          "text": "#security-headers",
          "url": "https://www.jkconcepts.at/en/website-security-glossary/#security-headers"
        }
      ]
    },
    {
      "type": "heading",
      "level": 3,
      "text": "What are security headers?"
    },
    {
      "type": "paragraph",
      "text": "Security Headers · HTTP security headers"
    },
    {
      "type": "paragraph",
      "text": "Security headers give the browser additional security rules for a website."
    },
    {
      "type": "heading",
      "level": 3,
      "text": "Technology, example and context"
    },
    {
      "type": "heading",
      "level": 4,
      "text": "Technical explanation"
    },
    {
      "type": "paragraph",
      "text": "CSP, HSTS, frame-ancestors, Referrer-Policy and other headers limit loading sources, protocol downgrades, embedding and the sharing of information."
    },
    {
      "type": "heading",
      "level": 4,
      "text": "Example"
    },
    {
      "type": "paragraph",
      "text": "A CSP prevents arbitrary third-party scripts from being executed on a page."
    },
    {
      "type": "heading",
      "level": 4,
      "text": "Related terms"
    },
    {
      "type": "paragraph",
      "text": "Content Security Policy HSTS HTTP Header Cross-Site Scripting",
      "links": [
        {
          "text": "Content Security Policy",
          "url": "https://www.jkconcepts.at/en/website-security-glossary/#csp"
        },
        {
          "text": "HSTS",
          "url": "https://www.jkconcepts.at/en/website-security-glossary/#hsts"
        },
        {
          "text": "HTTP Header",
          "url": "https://www.jkconcepts.at/en/website-security-glossary/#http-header"
        },
        {
          "text": "Cross-Site Scripting",
          "url": "https://www.jkconcepts.at/en/website-security-glossary/#xss"
        }
      ]
    },
    {
      "type": "paragraph",
      "text": "Securing your website technically? See website security →",
      "links": [
        {
          "text": "See website security →",
          "url": "https://www.jkconcepts.at/en/wordpress-security/"
        }
      ]
    },
    {
      "type": "paragraph",
      "text": "Safeguards · Basic #patch",
      "links": [
        {
          "text": "#patch",
          "url": "https://www.jkconcepts.at/en/website-security-glossary/#patch"
        }
      ]
    },
    {
      "type": "heading",
      "level": 3,
      "text": "What is a security patch?"
    },
    {
      "type": "paragraph",
      "text": "Security Patch · Security update"
    },
    {
      "type": "paragraph",
      "text": "A security patch is a change that fixes known security problems or makes exploiting them harder."
    },
    {
      "type": "heading",
      "level": 3,
      "text": "Technology, example and context"
    },
    {
      "type": "heading",
      "level": 4,
      "text": "Technical explanation"
    },
    {
      "type": "paragraph",
      "text": "Before installing, dependencies, compatibility, backups and a way back should be checked; delayed patches widen the window of attack."
    },
    {
      "type": "heading",
      "level": 4,
      "text": "Example"
    },
    {
      "type": "paragraph",
      "text": "A plugin update closes a published access control vulnerability."
    },
    {
      "type": "heading",
      "level": 4,
      "text": "Related terms"
    },
    {
      "type": "paragraph",
      "text": "Vulnerability CVE Backup WordPress Hardening",
      "links": [
        {
          "text": "Vulnerability",
          "url": "https://www.jkconcepts.at/en/website-security-glossary/#vulnerability"
        },
        {
          "text": "CVE",
          "url": "https://www.jkconcepts.at/en/website-security-glossary/#cve"
        },
        {
          "text": "Backup",
          "url": "https://www.jkconcepts.at/en/website-security-glossary/#backup"
        },
        {
          "text": "WordPress Hardening",
          "url": "https://www.jkconcepts.at/en/website-security-glossary/#wordpress-hardening"
        }
      ]
    },
    {
      "type": "paragraph",
      "text": "Ongoing care for updates, backups and monitoring? See WordPress maintenance →",
      "links": [
        {
          "text": "See WordPress maintenance →",
          "url": "https://www.jkconcepts.at/en/wordpress-maintenance/"
        }
      ]
    },
    {
      "type": "paragraph",
      "text": "Web basics · Advanced #session",
      "links": [
        {
          "text": "#session",
          "url": "https://www.jkconcepts.at/en/website-security-glossary/#session"
        }
      ]
    },
    {
      "type": "heading",
      "level": 3,
      "text": "What is a session?"
    },
    {
      "type": "paragraph",
      "text": "Session · Server-side session state"
    },
    {
      "type": "paragraph",
      "text": "A session keeps related user requests in a shared state across several page views."
    },
    {
      "type": "heading",
      "level": 3,
      "text": "Technology, example and context"
    },
    {
      "type": "heading",
      "level": 4,
      "text": "Technical explanation"
    },
    {
      "type": "paragraph",
      "text": "Usually the server stores the state and the browser only sends a random session ID in a protected cookie."
    },
    {
      "type": "heading",
      "level": 4,
      "text": "Example"
    },
    {
      "type": "paragraph",
      "text": "After login, the server recognises the logged-in user from the session ID."
    },
    {
      "type": "heading",
      "level": 4,
      "text": "Related terms"
    },
    {
      "type": "paragraph",
      "text": "Cookie Authentication Session Hijacking Backend",
      "links": [
        {
          "text": "Cookie",
          "url": "https://www.jkconcepts.at/en/website-security-glossary/#cookie"
        },
        {
          "text": "Authentication",
          "url": "https://www.jkconcepts.at/en/website-security-glossary/#authentication"
        },
        {
          "text": "Session Hijacking",
          "url": "https://www.jkconcepts.at/en/website-security-glossary/#session-hijacking"
        },
        {
          "text": "Backend",
          "url": "https://www.jkconcepts.at/en/website-security-glossary/#backend"
        }
      ]
    },
    {
      "type": "paragraph",
      "text": "Attacks · Advanced #session-hijacking",
      "links": [
        {
          "text": "#session-hijacking",
          "url": "https://www.jkconcepts.at/en/website-security-glossary/#session-hijacking"
        }
      ]
    },
    {
      "type": "heading",
      "level": 3,
      "text": "What is session hijacking?"
    },
    {
      "type": "paragraph",
      "text": "Session Hijacking · Taking over a session"
    },
    {
      "type": "paragraph",
      "text": "Session hijacking takes over a valid session without needing to know the original password."
    },
    {
      "type": "heading",
      "level": 3,
      "text": "Technology, example and context"
    },
    {
      "type": "heading",
      "level": 4,
      "text": "Technical explanation"
    },
    {
      "type": "paragraph",
      "text": "Session identifiers can be stolen through XSS, malware, insecure transmission or leaks; short lifetimes and re-authentication limit the consequences."
    },
    {
      "type": "heading",
      "level": 4,
      "text": "Example"
    },
    {
      "type": "paragraph",
      "text": "A stolen session cookie gives access to an account that is already logged in."
    },
    {
      "type": "heading",
      "level": 4,
      "text": "Related terms"
    },
    {
      "type": "paragraph",
      "text": "Session Cookie Cross-Site Scripting HttpOnly",
      "links": [
        {
          "text": "Session",
          "url": "https://www.jkconcepts.at/en/website-security-glossary/#session"
        },
        {
          "text": "Cookie",
          "url": "https://www.jkconcepts.at/en/website-security-glossary/#cookie"
        },
        {
          "text": "Cross-Site Scripting",
          "url": "https://www.jkconcepts.at/en/website-security-glossary/#xss"
        },
        {
          "text": "HttpOnly",
          "url": "https://www.jkconcepts.at/en/website-security-glossary/#httponly"
        }
      ]
    },
    {
      "type": "paragraph",
      "text": "Basics · Basic #social-engineering",
      "links": [
        {
          "text": "#social-engineering",
          "url": "https://www.jkconcepts.at/en/website-security-glossary/#social-engineering"
        }
      ]
    },
    {
      "type": "heading",
      "level": 3,
      "text": "What is social engineering?"
    },
    {
      "type": "paragraph",
      "text": "Social Engineering · Manipulating people"
    },
    {
      "type": "paragraph",
      "text": "Social engineering uses trust, time pressure or authority to get people to take risky actions."
    },
    {
      "type": "heading",
      "level": 3,
      "text": "Technology, example and context"
    },
    {
      "type": "heading",
      "level": 4,
      "text": "Technical explanation"
    },
    {
      "type": "paragraph",
      "text": "Technical controls help, but must be complemented by verifiable processes for access, payments and support requests."
    },
    {
      "type": "heading",
      "level": 4,
      "text": "Example"
    },
    {
      "type": "paragraph",
      "text": "A supposed managing director requests an urgent bank transfer by email."
    },
    {
      "type": "heading",
      "level": 4,
      "text": "Related terms"
    },
    {
      "type": "paragraph",
      "text": "Phishing MFA / 2FA Authentication",
      "links": [
        {
          "text": "Phishing",
          "url": "https://www.jkconcepts.at/en/website-security-glossary/#phishing"
        },
        {
          "text": "MFA / 2FA",
          "url": "https://www.jkconcepts.at/en/website-security-glossary/#mfa"
        },
        {
          "text": "Authentication",
          "url": "https://www.jkconcepts.at/en/website-security-glossary/#authentication"
        }
      ]
    },
    {
      "type": "paragraph",
      "text": "Attacks · Advanced #supply-chain-attack",
      "links": [
        {
          "text": "#supply-chain-attack",
          "url": "https://www.jkconcepts.at/en/website-security-glossary/#supply-chain-attack"
        }
      ]
    },
    {
      "type": "heading",
      "level": 3,
      "text": "What is a software supply chain attack?"
    },
    {
      "type": "paragraph",
      "text": "Software Supply Chain Attack · Attack via the software supply chain"
    },
    {
      "type": "paragraph",
      "text": "A supply chain attack compromises software via vendors, build processes, updates or dependencies."
    },
    {
      "type": "heading",
      "level": 3,
      "text": "Technology, example and context"
    },
    {
      "type": "heading",
      "level": 4,
      "text": "Technical explanation"
    },
    {
      "type": "paragraph",
      "text": "Protection includes verifiable sources, minimal dependencies, lockfiles, signatures, isolated builds, an inventory and a fast response to advisories."
    },
    {
      "type": "heading",
      "level": 4,
      "text": "Example"
    },
    {
      "type": "paragraph",
      "text": "A manipulated package version is pulled into many applications through a regular update."
    },
    {
      "type": "heading",
      "level": 4,
      "text": "Related terms"
    },
    {
      "type": "paragraph",
      "text": "Dependency Confusion Subresource Integrity Plugin Vulnerability CVE",
      "links": [
        {
          "text": "Dependency Confusion",
          "url": "https://www.jkconcepts.at/en/website-security-glossary/#dependency-confusion"
        },
        {
          "text": "Subresource Integrity",
          "url": "https://www.jkconcepts.at/en/website-security-glossary/#subresource-integrity"
        },
        {
          "text": "Plugin Vulnerability",
          "url": "https://www.jkconcepts.at/en/website-security-glossary/#plugin-vulnerability"
        },
        {
          "text": "CVE",
          "url": "https://www.jkconcepts.at/en/website-security-glossary/#cve"
        }
      ]
    },
    {
      "type": "paragraph",
      "text": "Attacks · Advanced #sql-injection",
      "links": [
        {
          "text": "#sql-injection",
          "url": "https://www.jkconcepts.at/en/website-security-glossary/#sql-injection"
        }
      ]
    },
    {
      "type": "heading",
      "level": 3,
      "text": "What is SQL injection?"
    },
    {
      "type": "paragraph",
      "text": "SQL Injection · Injecting SQL commands"
    },
    {
      "type": "paragraph",
      "text": "SQL injection arises when uncontrolled input can change the structure of a database query."
    },
    {
      "type": "heading",
      "level": 3,
      "text": "Technology, example and context"
    },
    {
      "type": "heading",
      "level": 4,
      "text": "Technical explanation"
    },
    {
      "type": "paragraph",
      "text": "Parameterised queries separate data from SQL syntax; further measures are minimal database permissions, secure error handling and input validation."
    },
    {
      "type": "heading",
      "level": 4,
      "text": "Example"
    },
    {
      "type": "paragraph",
      "text": "An application appends form input directly to an SQL string instead of using prepared parameters."
    },
    {
      "type": "heading",
      "level": 4,
      "text": "Related terms"
    },
    {
      "type": "paragraph",
      "text": "Database Injection Web Application Firewall Least Privilege",
      "links": [
        {
          "text": "Database",
          "url": "https://www.jkconcepts.at/en/web-technology-glossary/#database"
        },
        {
          "text": "Injection",
          "url": "https://www.jkconcepts.at/en/website-security-glossary/#injection"
        },
        {
          "text": "Web Application Firewall",
          "url": "https://www.jkconcepts.at/en/website-security-glossary/#waf"
        },
        {
          "text": "Least Privilege",
          "url": "https://www.jkconcepts.at/en/website-security-glossary/#least-privilege"
        }
      ]
    },
    {
      "type": "paragraph",
      "text": "Attacks · Technical #ssrf",
      "links": [
        {
          "text": "#ssrf",
          "url": "https://www.jkconcepts.at/en/website-security-glossary/#ssrf"
        }
      ]
    },
    {
      "type": "heading",
      "level": 3,
      "text": "What is SSRF?"
    },
    {
      "type": "paragraph",
      "text": "SSRF · Server-Side Request Forgery"
    },
    {
      "type": "paragraph",
      "text": "SSRF abuses a server function to call unauthorised targets from the server."
    },
    {
      "type": "heading",
      "level": 3,
      "text": "Technology, example and context"
    },
    {
      "type": "heading",
      "level": 4,
      "text": "Technical explanation"
    },
    {
      "type": "paragraph",
      "text": "URL importers, webhooks and proxies are at risk; protection requires target allowlisting, network segmentation and robust checks after DNS resolution and redirects."
    },
    {
      "type": "heading",
      "level": 4,
      "text": "Example"
    },
    {
      "type": "paragraph",
      "text": "An image importer is tricked into fetching an internal metadata endpoint instead of a public image."
    },
    {
      "type": "heading",
      "level": 4,
      "text": "Related terms"
    },
    {
      "type": "paragraph",
      "text": "Webhook API Least Privilege Zero Trust",
      "links": [
        {
          "text": "Webhook",
          "url": "https://www.jkconcepts.at/en/website-security-glossary/#webhook"
        },
        {
          "text": "API",
          "url": "https://www.jkconcepts.at/en/web-technology-glossary/#api"
        },
        {
          "text": "Least Privilege",
          "url": "https://www.jkconcepts.at/en/website-security-glossary/#least-privilege"
        },
        {
          "text": "Zero Trust",
          "url": "https://www.jkconcepts.at/en/website-security-glossary/#zero-trust"
        }
      ]
    },
    {
      "type": "paragraph",
      "text": "Safeguards · Technical #subresource-integrity",
      "links": [
        {
          "text": "#subresource-integrity",
          "url": "https://www.jkconcepts.at/en/website-security-glossary/#subresource-integrity"
        }
      ]
    },
    {
      "type": "heading",
      "level": 3,
      "text": "What is subresource integrity?"
    },
    {
      "type": "paragraph",
      "text": "Subresource Integrity · SRI"
    },
    {
      "type": "paragraph",
      "text": "SRI lets browsers check whether an externally loaded resource matches the expected cryptographic hash exactly."
    },
    {
      "type": "heading",
      "level": 3,
      "text": "Technology, example and context"
    },
    {
      "type": "heading",
      "level": 4,
      "text": "Technical explanation"
    },
    {
      "type": "paragraph",
      "text": "The integrity attribute contains one or more hash values; for cross-origin resources, the CORS configuration must allow the check."
    },
    {
      "type": "heading",
      "level": 4,
      "text": "Example"
    },
    {
      "type": "paragraph",
      "text": "A CDN script is only executed if its content matches the stored SHA-384 hash."
    },
    {
      "type": "heading",
      "level": 4,
      "text": "Related terms"
    },
    {
      "type": "paragraph",
      "text": "Content Security Policy Software Supply Chain Attack CORS Hashing",
      "links": [
        {
          "text": "Content Security Policy",
          "url": "https://www.jkconcepts.at/en/website-security-glossary/#csp"
        },
        {
          "text": "Software Supply Chain Attack",
          "url": "https://www.jkconcepts.at/en/website-security-glossary/#supply-chain-attack"
        },
        {
          "text": "CORS",
          "url": "https://www.jkconcepts.at/en/website-security-glossary/#cors"
        },
        {
          "text": "Hashing",
          "url": "https://www.jkconcepts.at/en/website-security-glossary/#hashing"
        }
      ]
    },
    {
      "type": "heading",
      "level": 2,
      "text": "Terms starting with T"
    },
    {
      "type": "paragraph",
      "text": "Web basics · Advanced #tls",
      "links": [
        {
          "text": "#tls",
          "url": "https://www.jkconcepts.at/en/website-security-glossary/#tls"
        }
      ]
    },
    {
      "type": "heading",
      "level": 3,
      "text": "What is TLS?"
    },
    {
      "type": "paragraph",
      "text": "TLS · Transport Layer Security"
    },
    {
      "type": "paragraph",
      "text": "TLS is a protocol for encrypted network connections that are protected against tampering."
    },
    {
      "type": "heading",
      "level": 3,
      "text": "Technology, example and context"
    },
    {
      "type": "heading",
      "level": 4,
      "text": "Technical explanation"
    },
    {
      "type": "paragraph",
      "text": "The handshake negotiates the version and cryptographic methods, checks certificates and derives session keys for symmetric encryption."
    },
    {
      "type": "heading",
      "level": 4,
      "text": "Example"
    },
    {
      "type": "paragraph",
      "text": "HTTPS, secure mail transfer and many APIs use TLS to protect the transport."
    },
    {
      "type": "heading",
      "level": 4,
      "text": "Related terms"
    },
    {
      "type": "paragraph",
      "text": "HTTPS TLS Certificate Encryption HSTS",
      "links": [
        {
          "text": "HTTPS",
          "url": "https://www.jkconcepts.at/en/website-security-glossary/#https"
        },
        {
          "text": "TLS Certificate",
          "url": "https://www.jkconcepts.at/en/website-security-glossary/#certificate"
        },
        {
          "text": "Encryption",
          "url": "https://www.jkconcepts.at/en/website-security-glossary/#encryption"
        },
        {
          "text": "HSTS",
          "url": "https://www.jkconcepts.at/en/website-security-glossary/#hsts"
        }
      ]
    },
    {
      "type": "paragraph",
      "text": "Web basics · Advanced #certificate",
      "links": [
        {
          "text": "#certificate",
          "url": "https://www.jkconcepts.at/en/website-security-glossary/#certificate"
        }
      ]
    },
    {
      "type": "heading",
      "level": 3,
      "text": "What is an SSL certificate?"
    },
    {
      "type": "paragraph",
      "text": "TLS Certificate · Digital certificate for a host name"
    },
    {
      "type": "paragraph",
      "text": "A TLS certificate confirms that a public key belongs to a domain name."
    },
    {
      "type": "heading",
      "level": 3,
      "text": "Technology, example and context"
    },
    {
      "type": "heading",
      "level": 4,
      "text": "Technical explanation"
    },
    {
      "type": "paragraph",
      "text": "Browsers check the signature, validity, host name and the certificate chain up to a trusted certificate authority."
    },
    {
      "type": "heading",
      "level": 4,
      "text": "Example"
    },
    {
      "type": "paragraph",
      "text": "Let’s Encrypt provides automatable domain certificates for HTTPS."
    },
    {
      "type": "heading",
      "level": 4,
      "text": "Related terms"
    },
    {
      "type": "paragraph",
      "text": "TLS HTTPS Encryption",
      "links": [
        {
          "text": "TLS",
          "url": "https://www.jkconcepts.at/en/website-security-glossary/#tls"
        },
        {
          "text": "HTTPS",
          "url": "https://www.jkconcepts.at/en/website-security-glossary/#https"
        },
        {
          "text": "Encryption",
          "url": "https://www.jkconcepts.at/en/website-security-glossary/#encryption"
        }
      ]
    },
    {
      "type": "paragraph",
      "text": "Identity & access · Advanced #totp",
      "links": [
        {
          "text": "#totp",
          "url": "https://www.jkconcepts.at/en/website-security-glossary/#totp"
        }
      ]
    },
    {
      "type": "heading",
      "level": 3,
      "text": "What is TOTP?"
    },
    {
      "type": "paragraph",
      "text": "TOTP · Time-based One-Time Password"
    },
    {
      "type": "paragraph",
      "text": "TOTP generates short-lived one-time codes from a shared secret key and the current time."
    },
    {
      "type": "heading",
      "level": 3,
      "text": "Technology, example and context"
    },
    {
      "type": "heading",
      "level": 4,
      "text": "Technical explanation"
    },
    {
      "type": "paragraph",
      "text": "Server and authenticator compute the same value in time windows; the method is stronger than a password alone, but not fully phishing-resistant."
    },
    {
      "type": "heading",
      "level": 4,
      "text": "Example"
    },
    {
      "type": "paragraph",
      "text": "An authenticator app shows a new six-digit code every 30 seconds."
    },
    {
      "type": "heading",
      "level": 4,
      "text": "Related terms"
    },
    {
      "type": "paragraph",
      "text": "MFA / 2FA Authentication Passkey Phishing",
      "links": [
        {
          "text": "MFA / 2FA",
          "url": "https://www.jkconcepts.at/en/website-security-glossary/#mfa"
        },
        {
          "text": "Authentication",
          "url": "https://www.jkconcepts.at/en/website-security-glossary/#authentication"
        },
        {
          "text": "Passkey",
          "url": "https://www.jkconcepts.at/en/website-security-glossary/#passkey"
        },
        {
          "text": "Phishing",
          "url": "https://www.jkconcepts.at/en/website-security-glossary/#phishing"
        }
      ]
    },
    {
      "type": "heading",
      "level": 2,
      "text": "Terms starting with V"
    },
    {
      "type": "paragraph",
      "text": "Basics · Basic #vulnerability",
      "links": [
        {
          "text": "#vulnerability",
          "url": "https://www.jkconcepts.at/en/website-security-glossary/#vulnerability"
        }
      ]
    },
    {
      "type": "heading",
      "level": 3,
      "text": "What is a security vulnerability?"
    },
    {
      "type": "paragraph",
      "text": "Vulnerability · Security hole or weakness"
    },
    {
      "type": "paragraph",
      "text": "A vulnerability is a weakness that can impair the security properties of a system."
    },
    {
      "type": "heading",
      "level": 3,
      "text": "Technology, example and context"
    },
    {
      "type": "heading",
      "level": 4,
      "text": "Technical explanation"
    },
    {
      "type": "paragraph",
      "text": "Vulnerabilities can arise from code errors, insecure design, misconfiguration, dependencies or poor operating processes."
    },
    {
      "type": "heading",
      "level": 4,
      "text": "Example"
    },
    {
      "type": "paragraph",
      "text": "A missing permission check allows a user to access other people’s records."
    },
    {
      "type": "heading",
      "level": 4,
      "text": "Related terms"
    },
    {
      "type": "paragraph",
      "text": "Exploit CVE CWE Security Patch",
      "links": [
        {
          "text": "Exploit",
          "url": "https://www.jkconcepts.at/en/website-security-glossary/#exploit"
        },
        {
          "text": "CVE",
          "url": "https://www.jkconcepts.at/en/website-security-glossary/#cve"
        },
        {
          "text": "CWE",
          "url": "https://www.jkconcepts.at/en/website-security-glossary/#cwe"
        },
        {
          "text": "Security Patch",
          "url": "https://www.jkconcepts.at/en/website-security-glossary/#patch"
        }
      ]
    },
    {
      "type": "heading",
      "level": 2,
      "text": "Terms starting with W"
    },
    {
      "type": "paragraph",
      "text": "Safeguards · Advanced #waf",
      "links": [
        {
          "text": "#waf",
          "url": "https://www.jkconcepts.at/en/website-security-glossary/#waf"
        }
      ]
    },
    {
      "type": "heading",
      "level": 3,
      "text": "What is a web application firewall?"
    },
    {
      "type": "paragraph",
      "text": "Web Application Firewall · WAF"
    },
    {
      "type": "paragraph",
      "text": "A WAF analyses HTTP traffic and blocks suspicious requests before they reach a web application."
    },
    {
      "type": "heading",
      "level": 3,
      "text": "Technology, example and context"
    },
    {
      "type": "heading",
      "level": 4,
      "text": "Technical explanation"
    },
    {
      "type": "paragraph",
      "text": "Rules can detect known attack patterns, bots, rates and application-specific anomalies; a WAF does not replace a secure application."
    },
    {
      "type": "heading",
      "level": 4,
      "text": "Example"
    },
    {
      "type": "paragraph",
      "text": "A virtual patch rule blocks known exploit requests until a software update has been installed."
    },
    {
      "type": "heading",
      "level": 4,
      "text": "Related terms"
    },
    {
      "type": "paragraph",
      "text": "Firewall SQL Injection Cross-Site Scripting Zero-Day",
      "links": [
        {
          "text": "Firewall",
          "url": "https://www.jkconcepts.at/en/website-security-glossary/#firewall"
        },
        {
          "text": "SQL Injection",
          "url": "https://www.jkconcepts.at/en/website-security-glossary/#sql-injection"
        },
        {
          "text": "Cross-Site Scripting",
          "url": "https://www.jkconcepts.at/en/website-security-glossary/#xss"
        },
        {
          "text": "Zero-Day",
          "url": "https://www.jkconcepts.at/en/website-security-glossary/#zero-day"
        }
      ]
    },
    {
      "type": "paragraph",
      "text": "Securing your website technically? See website security →",
      "links": [
        {
          "text": "See website security →",
          "url": "https://www.jkconcepts.at/en/wordpress-security/"
        }
      ]
    },
    {
      "type": "paragraph",
      "text": "Web basics · Basic #webserver",
      "links": [
        {
          "text": "#webserver",
          "url": "https://www.jkconcepts.at/en/website-security-glossary/#webserver"
        }
      ]
    },
    {
      "type": "heading",
      "level": 3,
      "text": "What is a web server?"
    },
    {
      "type": "paragraph",
      "text": "Web Server · Server for HTTP requests"
    },
    {
      "type": "paragraph",
      "text": "A web server accepts HTTP requests and delivers files or dynamically generated responses to browsers and other clients."
    },
    {
      "type": "heading",
      "level": 3,
      "text": "Technology, example and context"
    },
    {
      "type": "heading",
      "level": 4,
      "text": "Technical explanation"
    },
    {
      "type": "paragraph",
      "text": "Software such as nginx or Apache handles TLS, routing, caching, compression and forwarding to application processes."
    },
    {
      "type": "heading",
      "level": 4,
      "text": "Example"
    },
    {
      "type": "paragraph",
      "text": "The web server delivers a static HTML file directly or forwards a PHP request to PHP-FPM."
    },
    {
      "type": "heading",
      "level": 4,
      "text": "Related terms"
    },
    {
      "type": "paragraph",
      "text": "HTTP Request & Response Web Hosting Backend",
      "links": [
        {
          "text": "HTTP",
          "url": "https://www.jkconcepts.at/en/web-technology-glossary/#http"
        },
        {
          "text": "Request & Response",
          "url": "https://www.jkconcepts.at/en/web-technology-glossary/#request-response"
        },
        {
          "text": "Web Hosting",
          "url": "https://www.jkconcepts.at/en/web-technology-glossary/#webhosting"
        },
        {
          "text": "Backend",
          "url": "https://www.jkconcepts.at/en/website-security-glossary/#backend"
        }
      ]
    },
    {
      "type": "paragraph",
      "text": "Identity & access · Technical #webauthn",
      "links": [
        {
          "text": "#webauthn",
          "url": "https://www.jkconcepts.at/en/website-security-glossary/#webauthn"
        }
      ]
    },
    {
      "type": "heading",
      "level": 3,
      "text": "What is WebAuthn?"
    },
    {
      "type": "paragraph",
      "text": "WebAuthn · Web Authentication API"
    },
    {
      "type": "paragraph",
      "text": "WebAuthn is the browser API for strong public-key logins with passkeys and security keys."
    },
    {
      "type": "heading",
      "level": 3,
      "text": "Technology, example and context"
    },
    {
      "type": "heading",
      "level": 4,
      "text": "Technical explanation"
    },
    {
      "type": "paragraph",
      "text": "The server sends a challenge; the authenticator signs it for the specific relying party, preventing simple phishing reuse."
    },
    {
      "type": "heading",
      "level": 4,
      "text": "Example"
    },
    {
      "type": "paragraph",
      "text": "A hardware security key confirms the administrator login."
    },
    {
      "type": "heading",
      "level": 4,
      "text": "Related terms"
    },
    {
      "type": "paragraph",
      "text": "Passkey Authentication MFA / 2FA Phishing",
      "links": [
        {
          "text": "Passkey",
          "url": "https://www.jkconcepts.at/en/website-security-glossary/#passkey"
        },
        {
          "text": "Authentication",
          "url": "https://www.jkconcepts.at/en/website-security-glossary/#authentication"
        },
        {
          "text": "MFA / 2FA",
          "url": "https://www.jkconcepts.at/en/website-security-glossary/#mfa"
        },
        {
          "text": "Phishing",
          "url": "https://www.jkconcepts.at/en/website-security-glossary/#phishing"
        }
      ]
    },
    {
      "type": "paragraph",
      "text": "Web basics · Advanced #webhook",
      "links": [
        {
          "text": "#webhook",
          "url": "https://www.jkconcepts.at/en/website-security-glossary/#webhook"
        }
      ]
    },
    {
      "type": "heading",
      "level": 3,
      "text": "What is a webhook?"
    },
    {
      "type": "paragraph",
      "text": "Webhook · Event-driven HTTP call"
    },
    {
      "type": "paragraph",
      "text": "A webhook automatically informs another system about an event via HTTP."
    },
    {
      "type": "heading",
      "level": 3,
      "text": "Technology, example and context"
    },
    {
      "type": "heading",
      "level": 4,
      "text": "Technical explanation"
    },
    {
      "type": "paragraph",
      "text": "The sender calls a registered URL; receivers should check signatures, tolerate retries and make processing idempotent."
    },
    {
      "type": "heading",
      "level": 4,
      "text": "Example"
    },
    {
      "type": "paragraph",
      "text": "A payment provider tells the shop that a payment has been completed successfully."
    },
    {
      "type": "heading",
      "level": 4,
      "text": "Related terms"
    },
    {
      "type": "paragraph",
      "text": "API REST API Authentication Rate Limiting",
      "links": [
        {
          "text": "API",
          "url": "https://www.jkconcepts.at/en/web-technology-glossary/#api"
        },
        {
          "text": "REST API",
          "url": "https://www.jkconcepts.at/en/web-technology-glossary/#rest-api"
        },
        {
          "text": "Authentication",
          "url": "https://www.jkconcepts.at/en/website-security-glossary/#authentication"
        },
        {
          "text": "Rate Limiting",
          "url": "https://www.jkconcepts.at/en/website-security-glossary/#rate-limiting"
        }
      ]
    },
    {
      "type": "paragraph",
      "text": "Basics · Basic #website-security",
      "links": [
        {
          "text": "#website-security",
          "url": "https://www.jkconcepts.at/en/website-security-glossary/#website-security"
        }
      ]
    },
    {
      "type": "heading",
      "level": 3,
      "text": "What is website security?"
    },
    {
      "type": "paragraph",
      "text": "Website Security · Protecting websites and web applications"
    },
    {
      "type": "paragraph",
      "text": "Website security covers technical and organisational measures against unauthorised access, tampering, data loss and outages."
    },
    {
      "type": "heading",
      "level": 3,
      "text": "Technology, example and context"
    },
    {
      "type": "heading",
      "level": 4,
      "text": "Technical explanation"
    },
    {
      "type": "paragraph",
      "text": "Effective protection combines secure development, minimal permissions, updates, hardening, backups, monitoring and a prepared response process."
    },
    {
      "type": "heading",
      "level": 4,
      "text": "Example"
    },
    {
      "type": "paragraph",
      "text": "A WordPress website is kept up to date, protected with MFA, monitored and backed up regularly."
    },
    {
      "type": "heading",
      "level": 4,
      "text": "Why does it matter?"
    },
    {
      "type": "paragraph",
      "text": "Security is not a single plugin, but an ongoing process across application, hosting, accounts and operation."
    },
    {
      "type": "heading",
      "level": 4,
      "text": "Related terms"
    },
    {
      "type": "paragraph",
      "text": "Vulnerability WordPress Hardening Monitoring Backup",
      "links": [
        {
          "text": "Vulnerability",
          "url": "https://www.jkconcepts.at/en/website-security-glossary/#vulnerability"
        },
        {
          "text": "WordPress Hardening",
          "url": "https://www.jkconcepts.at/en/website-security-glossary/#wordpress-hardening"
        },
        {
          "text": "Monitoring",
          "url": "https://www.jkconcepts.at/en/website-security-glossary/#monitoring"
        },
        {
          "text": "Backup",
          "url": "https://www.jkconcepts.at/en/website-security-glossary/#backup"
        }
      ]
    },
    {
      "type": "paragraph",
      "text": "Securing your website technically? See website security →",
      "links": [
        {
          "text": "See website security →",
          "url": "https://www.jkconcepts.at/en/wordpress-security/"
        }
      ]
    },
    {
      "type": "paragraph",
      "text": "Web basics · Basic #wordpress",
      "links": [
        {
          "text": "#wordpress",
          "url": "https://www.jkconcepts.at/en/website-security-glossary/#wordpress"
        }
      ]
    },
    {
      "type": "heading",
      "level": 3,
      "text": "What is WordPress?"
    },
    {
      "type": "paragraph",
      "text": "WordPress · Open-source content management system"
    },
    {
      "type": "paragraph",
      "text": "WordPress is a widely used open-source CMS for websites, editorial content and, with extensions, online shops."
    },
    {
      "type": "heading",
      "level": 3,
      "text": "Technology, example and context"
    },
    {
      "type": "heading",
      "level": 4,
      "text": "Technical explanation"
    },
    {
      "type": "paragraph",
      "text": "WordPress is based mainly on PHP and MySQL, has theme, plugin, hook, role and REST API systems and needs ongoing updates."
    },
    {
      "type": "heading",
      "level": 4,
      "text": "Example"
    },
    {
      "type": "paragraph",
      "text": "A custom theme reflects the corporate design, while structured content fields make maintenance easier."
    },
    {
      "type": "heading",
      "level": 4,
      "text": "Why does it matter?"
    },
    {
      "type": "paragraph",
      "text": "Quality depends heavily on architecture, extensions, maintenance, hosting and security configuration."
    },
    {
      "type": "heading",
      "level": 4,
      "text": "Related terms"
    },
    {
      "type": "paragraph",
      "text": "CMS PHP MySQL WordPress Hardening",
      "links": [
        {
          "text": "CMS",
          "url": "https://www.jkconcepts.at/en/web-technology-glossary/#cms"
        },
        {
          "text": "PHP",
          "url": "https://www.jkconcepts.at/en/web-technology-glossary/#php"
        },
        {
          "text": "MySQL",
          "url": "https://www.jkconcepts.at/en/web-technology-glossary/#mysql"
        },
        {
          "text": "WordPress Hardening",
          "url": "https://www.jkconcepts.at/en/website-security-glossary/#wordpress-hardening"
        }
      ]
    },
    {
      "type": "paragraph",
      "text": "Building WordPress your way – and maintainable? See WordPress development →",
      "links": [
        {
          "text": "See WordPress development →",
          "url": "https://www.jkconcepts.at/en/wordpress-development/"
        }
      ]
    },
    {
      "type": "paragraph",
      "text": "WordPress security · Advanced #wordpress-hardening",
      "links": [
        {
          "text": "#wordpress-hardening",
          "url": "https://www.jkconcepts.at/en/website-security-glossary/#wordpress-hardening"
        }
      ]
    },
    {
      "type": "heading",
      "level": 3,
      "text": "What is WordPress hardening?"
    },
    {
      "type": "paragraph",
      "text": "WordPress Hardening · Targeted hardening of a WordPress installation"
    },
    {
      "type": "paragraph",
      "text": "WordPress hardening reduces unnecessary attack surface and limits the consequences of a security problem."
    },
    {
      "type": "heading",
      "level": 3,
      "text": "Technology, example and context"
    },
    {
      "type": "heading",
      "level": 4,
      "text": "Technical explanation"
    },
    {
      "type": "paragraph",
      "text": "This includes minimal extensions and permissions, secure accounts, updates, a protected configuration, restrictive file permissions, headers, backups and monitoring."
    },
    {
      "type": "heading",
      "level": 4,
      "text": "Example"
    },
    {
      "type": "paragraph",
      "text": "Unused plugins are removed, administrators use MFA and critical files are not publicly writable."
    },
    {
      "type": "heading",
      "level": 4,
      "text": "Related terms"
    },
    {
      "type": "paragraph",
      "text": "WordPress Plugin Vulnerability File Integrity Monitoring Backup",
      "links": [
        {
          "text": "WordPress",
          "url": "https://www.jkconcepts.at/en/website-security-glossary/#wordpress"
        },
        {
          "text": "Plugin Vulnerability",
          "url": "https://www.jkconcepts.at/en/website-security-glossary/#plugin-vulnerability"
        },
        {
          "text": "File Integrity Monitoring",
          "url": "https://www.jkconcepts.at/en/website-security-glossary/#file-integrity-monitoring"
        },
        {
          "text": "Backup",
          "url": "https://www.jkconcepts.at/en/website-security-glossary/#backup"
        }
      ]
    },
    {
      "type": "paragraph",
      "text": "Hardening WordPress before something happens? See WordPress security →",
      "links": [
        {
          "text": "See WordPress security →",
          "url": "https://www.jkconcepts.at/en/wordpress-security/"
        }
      ]
    },
    {
      "type": "paragraph",
      "text": "WordPress security · Technical #wordpress-nonce",
      "links": [
        {
          "text": "#wordpress-nonce",
          "url": "https://www.jkconcepts.at/en/website-security-glossary/#wordpress-nonce"
        }
      ]
    },
    {
      "type": "heading",
      "level": 3,
      "text": "What is a WordPress nonce?"
    },
    {
      "type": "paragraph",
      "text": "WordPress Nonce · Time-limited proof of an action"
    },
    {
      "type": "paragraph",
      "text": "A WordPress nonce confirms that an action was triggered from an expected application context."
    },
    {
      "type": "heading",
      "level": 3,
      "text": "Technology, example and context"
    },
    {
      "type": "heading",
      "level": 4,
      "text": "Technical explanation"
    },
    {
      "type": "paragraph",
      "text": "WordPress nonces are time-based tokens rather than single-use random values; they complement, but don’t replace, permission checks."
    },
    {
      "type": "heading",
      "level": 4,
      "text": "Example"
    },
    {
      "type": "paragraph",
      "text": "An admin form checks the nonce and capability before making a change."
    },
    {
      "type": "heading",
      "level": 4,
      "text": "Related terms"
    },
    {
      "type": "paragraph",
      "text": "CSRF Authorisation WordPress Authentication",
      "links": [
        {
          "text": "CSRF",
          "url": "https://www.jkconcepts.at/en/website-security-glossary/#csrf"
        },
        {
          "text": "Authorisation",
          "url": "https://www.jkconcepts.at/en/website-security-glossary/#authorization"
        },
        {
          "text": "WordPress",
          "url": "https://www.jkconcepts.at/en/website-security-glossary/#wordpress"
        },
        {
          "text": "Authentication",
          "url": "https://www.jkconcepts.at/en/website-security-glossary/#authentication"
        }
      ]
    },
    {
      "type": "paragraph",
      "text": "WordPress security · Technical #wordpress-security-keys",
      "links": [
        {
          "text": "#wordpress-security-keys",
          "url": "https://www.jkconcepts.at/en/website-security-glossary/#wordpress-security-keys"
        }
      ]
    },
    {
      "type": "heading",
      "level": 3,
      "text": "What are WordPress security keys?"
    },
    {
      "type": "paragraph",
      "text": "WordPress Security Keys · Authentication keys and salts"
    },
    {
      "type": "paragraph",
      "text": "WordPress security keys and salts strengthen cryptographic signatures for cookies and other security values."
    },
    {
      "type": "heading",
      "level": 3,
      "text": "Technology, example and context"
    },
    {
      "type": "heading",
      "level": 4,
      "text": "Technical explanation"
    },
    {
      "type": "paragraph",
      "text": "The secret random values are stored in wp-config.php; changing them invalidates existing login cookies and requires secure file permissions."
    },
    {
      "type": "heading",
      "level": 4,
      "text": "Example"
    },
    {
      "type": "paragraph",
      "text": "After a security incident, the keys are rotated so that old sessions lose their validity."
    },
    {
      "type": "heading",
      "level": 4,
      "text": "Related terms"
    },
    {
      "type": "paragraph",
      "text": "Hashing Cookie Session WordPress Hardening",
      "links": [
        {
          "text": "Hashing",
          "url": "https://www.jkconcepts.at/en/website-security-glossary/#hashing"
        },
        {
          "text": "Cookie",
          "url": "https://www.jkconcepts.at/en/website-security-glossary/#cookie"
        },
        {
          "text": "Session",
          "url": "https://www.jkconcepts.at/en/website-security-glossary/#session"
        },
        {
          "text": "WordPress Hardening",
          "url": "https://www.jkconcepts.at/en/website-security-glossary/#wordpress-hardening"
        }
      ]
    },
    {
      "type": "paragraph",
      "text": "WordPress security · Technical #wp-cron",
      "links": [
        {
          "text": "#wp-cron",
          "url": "https://www.jkconcepts.at/en/website-security-glossary/#wp-cron"
        }
      ]
    },
    {
      "type": "heading",
      "level": 3,
      "text": "What is WP-Cron?"
    },
    {
      "type": "paragraph",
      "text": "WP-Cron · Event scheduling in WordPress"
    },
    {
      "type": "paragraph",
      "text": "WP-Cron runs scheduled WordPress tasks, but by default is triggered by page views."
    },
    {
      "type": "heading",
      "level": 3,
      "text": "Technology, example and context"
    },
    {
      "type": "heading",
      "level": 4,
      "text": "Technical explanation"
    },
    {
      "type": "paragraph",
      "text": "With irregular or high traffic, a real system cron can be more reliable; blocked or overloaded cron runs affect updates and background jobs."
    },
    {
      "type": "heading",
      "level": 4,
      "text": "Example"
    },
    {
      "type": "paragraph",
      "text": "Scheduled publications and WooCommerce background tasks depend on cron events running reliably."
    },
    {
      "type": "heading",
      "level": 4,
      "text": "Related terms"
    },
    {
      "type": "paragraph",
      "text": "WordPress Monitoring Backend",
      "links": [
        {
          "text": "WordPress",
          "url": "https://www.jkconcepts.at/en/website-security-glossary/#wordpress"
        },
        {
          "text": "Monitoring",
          "url": "https://www.jkconcepts.at/en/website-security-glossary/#monitoring"
        },
        {
          "text": "Backend",
          "url": "https://www.jkconcepts.at/en/website-security-glossary/#backend"
        }
      ]
    },
    {
      "type": "heading",
      "level": 2,
      "text": "Terms starting with X"
    },
    {
      "type": "paragraph",
      "text": "WordPress security · Technical #xml-rpc",
      "links": [
        {
          "text": "#xml-rpc",
          "url": "https://www.jkconcepts.at/en/website-security-glossary/#xml-rpc"
        }
      ]
    },
    {
      "type": "heading",
      "level": 3,
      "text": "What is XML-RPC in WordPress?"
    },
    {
      "type": "paragraph",
      "text": "XML-RPC · WordPress interface via XML and HTTP"
    },
    {
      "type": "paragraph",
      "text": "XML-RPC is an older WordPress interface for remote calls that some apps and integrations use."
    },
    {
      "type": "heading",
      "level": 3,
      "text": "Technology, example and context"
    },
    {
      "type": "heading",
      "level": 4,
      "text": "Technical explanation"
    },
    {
      "type": "paragraph",
      "text": "Methods that aren’t needed can be disabled or limited at the edge; switching it off across the board can affect dependent features."
    },
    {
      "type": "heading",
      "level": 4,
      "text": "Example"
    },
    {
      "type": "paragraph",
      "text": "Automated login attempts abuse reachable XML-RPC methods."
    },
    {
      "type": "heading",
      "level": 4,
      "text": "Related terms"
    },
    {
      "type": "paragraph",
      "text": "WordPress Brute Force API Rate Limiting",
      "links": [
        {
          "text": "WordPress",
          "url": "https://www.jkconcepts.at/en/website-security-glossary/#wordpress"
        },
        {
          "text": "Brute Force",
          "url": "https://www.jkconcepts.at/en/website-security-glossary/#brute-force"
        },
        {
          "text": "API",
          "url": "https://www.jkconcepts.at/en/web-technology-glossary/#api"
        },
        {
          "text": "Rate Limiting",
          "url": "https://www.jkconcepts.at/en/website-security-glossary/#rate-limiting"
        }
      ]
    },
    {
      "type": "heading",
      "level": 2,
      "text": "Terms starting with Z"
    },
    {
      "type": "paragraph",
      "text": "Identity & access · Advanced #zero-trust",
      "links": [
        {
          "text": "#zero-trust",
          "url": "https://www.jkconcepts.at/en/website-security-glossary/#zero-trust"
        }
      ]
    },
    {
      "type": "heading",
      "level": 3,
      "text": "What does zero trust mean?"
    },
    {
      "type": "paragraph",
      "text": "Zero Trust · Continuously verified access"
    },
    {
      "type": "paragraph",
      "text": "Zero trust does not automatically treat location or network membership as proof of trust."
    },
    {
      "type": "heading",
      "level": 3,
      "text": "Technology, example and context"
    },
    {
      "type": "heading",
      "level": 4,
      "text": "Technical explanation"
    },
    {
      "type": "paragraph",
      "text": "Access is assessed on the basis of identity, device state, context, minimal permissions and ongoing signals."
    },
    {
      "type": "heading",
      "level": 4,
      "text": "Example"
    },
    {
      "type": "paragraph",
      "text": "An internal admin service requires a strong login and explicit permission even from within the company network."
    },
    {
      "type": "heading",
      "level": 4,
      "text": "Related terms"
    },
    {
      "type": "paragraph",
      "text": "Authentication Authorisation Least Privilege MFA / 2FA",
      "links": [
        {
          "text": "Authentication",
          "url": "https://www.jkconcepts.at/en/website-security-glossary/#authentication"
        },
        {
          "text": "Authorisation",
          "url": "https://www.jkconcepts.at/en/website-security-glossary/#authorization"
        },
        {
          "text": "Least Privilege",
          "url": "https://www.jkconcepts.at/en/website-security-glossary/#least-privilege"
        },
        {
          "text": "MFA / 2FA",
          "url": "https://www.jkconcepts.at/en/website-security-glossary/#mfa"
        }
      ]
    },
    {
      "type": "paragraph",
      "text": "Basics · Advanced #zero-day",
      "links": [
        {
          "text": "#zero-day",
          "url": "https://www.jkconcepts.at/en/website-security-glossary/#zero-day"
        }
      ]
    },
    {
      "type": "heading",
      "level": 3,
      "text": "What is a zero-day?"
    },
    {
      "type": "paragraph",
      "text": "Zero-Day · A vulnerability not yet fixed"
    },
    {
      "type": "paragraph",
      "text": "A zero-day is a vulnerability for which no generally available fix exists at the relevant point in time."
    },
    {
      "type": "heading",
      "level": 3,
      "text": "Technology, example and context"
    },
    {
      "type": "heading",
      "level": 4,
      "text": "Technical explanation"
    },
    {
      "type": "paragraph",
      "text": "Compensating controls such as WAF rules, disabling features, isolation or restricting access can reduce the risk until a patch is available."
    },
    {
      "type": "heading",
      "level": 4,
      "text": "Example"
    },
    {
      "type": "paragraph",
      "text": "An actively attacked plugin has to be deactivated temporarily because no update is available yet."
    },
    {
      "type": "heading",
      "level": 4,
      "text": "Related terms"
    },
    {
      "type": "paragraph",
      "text": "Vulnerability Exploit Security Patch Web Application Firewall",
      "links": [
        {
          "text": "Vulnerability",
          "url": "https://www.jkconcepts.at/en/website-security-glossary/#vulnerability"
        },
        {
          "text": "Exploit",
          "url": "https://www.jkconcepts.at/en/website-security-glossary/#exploit"
        },
        {
          "text": "Security Patch",
          "url": "https://www.jkconcepts.at/en/website-security-glossary/#patch"
        },
        {
          "text": "Web Application Firewall",
          "url": "https://www.jkconcepts.at/en/website-security-glossary/#waf"
        }
      ]
    },
    {
      "type": "paragraph",
      "text": "Check the risk properly"
    },
    {
      "type": "heading",
      "level": 2,
      "text": "Not sure how well your website is protected?"
    },
    {
      "type": "paragraph",
      "text": "A technical review shows outdated components, misconfigurations, missing layers of protection and sensible next steps."
    }
  ]
}