--- canonical: https://www.jkconcepts.at/en/website-security-glossary/ robots: noindex, follow --- Website security glossary # Website security: cybersecurity terms explained What are XSS, SQL injection or a WAF? How do MFA, security headers and backups protect a website? This glossary explains risks and countermeasures clearly and with technical precision. [Browse the terms](https://www.jkconcepts.at/en/website-security-glossary/#glossar) [All knowledge areas](https://www.jkconcepts.at/en/knowledge/) At a glance ### Scope 82 terms ### Reading levels Simple and technical ### Last updated October 2026 Understand attacks, put protection in context ## Website security from A to Z The terms focus on websites, web applications, WordPress and secure operations – with cross-references between attacks, causes and safeguards. Search for a term or question Topic **82** terms shown Recognise risks ## Common attacks & vulnerabilities Starting points for acute problems, typical web attacks and published security vulnerabilities. [Vulnerability](https://www.jkconcepts.at/en/website-security-glossary/#vulnerability) [Malware](https://www.jkconcepts.at/en/website-security-glossary/#malware) [Phishing](https://www.jkconcepts.at/en/website-security-glossary/#phishing) [Brute Force](https://www.jkconcepts.at/en/website-security-glossary/#brute-force) [Credential Stuffing](https://www.jkconcepts.at/en/website-security-glossary/#credential-stuffing) [SQL Injection](https://www.jkconcepts.at/en/website-security-glossary/#sql-injection) [Cross-Site Scripting](https://www.jkconcepts.at/en/website-security-glossary/#xss) [CSRF](https://www.jkconcepts.at/en/website-security-glossary/#csrf) [SSRF](https://www.jkconcepts.at/en/website-security-glossary/#ssrf) [Remote Code Execution](https://www.jkconcepts.at/en/website-security-glossary/#rce) [Backdoor](https://www.jkconcepts.at/en/website-security-glossary/#backdoor) [CVE](https://www.jkconcepts.at/en/website-security-glossary/#cve) Build protection ### Controls & secure operations Technical and organisational layers of protection for applications, accounts and recovery. [Web Application Firewall](https://www.jkconcepts.at/en/website-security-glossary/#waf) [MFA / 2FA](https://www.jkconcepts.at/en/website-security-glossary/#mfa) [Least Privilege](https://www.jkconcepts.at/en/website-security-glossary/#least-privilege) [Security Headers](https://www.jkconcepts.at/en/website-security-glossary/#security-headers) [Content Security Policy](https://www.jkconcepts.at/en/website-security-glossary/#csp) [HSTS](https://www.jkconcepts.at/en/website-security-glossary/#hsts) [Rate Limiting](https://www.jkconcepts.at/en/website-security-glossary/#rate-limiting) [Backup](https://www.jkconcepts.at/en/website-security-glossary/#backup) [Monitoring](https://www.jkconcepts.at/en/website-security-glossary/#monitoring) [WordPress Hardening](https://www.jkconcepts.at/en/website-security-glossary/#wordpress-hardening) [File Integrity Monitoring](https://www.jkconcepts.at/en/website-security-glossary/#file-integrity-monitoring) ## Terms starting with A AI security · Advanced [#ai-guardrails](https://www.jkconcepts.at/en/website-security-glossary/#ai-guardrails) ### What does AI Guardrails mean? AI Guardrails · Technical and organisational guardrails Rules, checks and limits around the inputs, outputs and actions of an AI system. ### Technology, example and context #### Example An application blocks sensitive data, validates outputs and requires approval before external actions. #### Why does it matter? Guardrails reduce certain risks, but must be implemented in several layers and tested regularly against real failure cases. #### Related terms [Human in the Loop](https://www.jkconcepts.at/en/ai-glossary/#human-in-the-loop) [Prompt Injection](https://www.jkconcepts.at/en/website-security-glossary/#prompt-injection) [Evaluation, Evals & Benchmarks](https://www.jkconcepts.at/en/ai-glossary/#evaluation-evals) Identity & access · Basic [#authentication](https://www.jkconcepts.at/en/website-security-glossary/#authentication) ### What is authentication? Authentication · Verifying an identity Authentication checks who a user or system is. ### Technology, example and context #### Technical explanation After a successful check, a system usually issues a session or token; secure methods also cover recovery and logout. #### Example A user proves their identity with a passkey or with a password plus TOTP. #### Related terms [Authorisation](https://www.jkconcepts.at/en/website-security-glossary/#authorization) [MFA / 2FA](https://www.jkconcepts.at/en/website-security-glossary/#mfa) [Session](https://www.jkconcepts.at/en/website-security-glossary/#session) [Passkey](https://www.jkconcepts.at/en/website-security-glossary/#passkey) Identity & access · Basic [#authorization](https://www.jkconcepts.at/en/website-security-glossary/#authorization) ### What is authorisation? Authorisation · Permission check Authorisation decides which data and actions an identified person or system may use. ### Technology, example and context #### Technical explanation Checks must happen on the server for every protected object and every action; roles alone are often not enough for object-specific rules. #### Example An editor may edit content but not manage user accounts. #### Related terms [Authentication](https://www.jkconcepts.at/en/website-security-glossary/#authentication) [Least Privilege](https://www.jkconcepts.at/en/website-security-glossary/#least-privilege) [Privilege Escalation](https://www.jkconcepts.at/en/website-security-glossary/#privilege-escalation) [Zero Trust](https://www.jkconcepts.at/en/website-security-glossary/#zero-trust) ## Terms starting with B WordPress security · Advanced [#backdoor](https://www.jkconcepts.at/en/website-security-glossary/#backdoor) ### What is a backdoor? Backdoor · Hidden persistent access A backdoor enables hidden access that bypasses regular security controls. ### Technology, example and context #### Technical explanation Backdoors can persist as obfuscated files, manipulated plugins, database content, user accounts or scheduled tasks. #### Example A seemingly harmless PHP file executes commands from an encrypted request parameter. #### Related terms [Malware](https://www.jkconcepts.at/en/website-security-glossary/#malware) [Remote Code Execution](https://www.jkconcepts.at/en/website-security-glossary/#rce) [File Integrity Monitoring](https://www.jkconcepts.at/en/website-security-glossary/#file-integrity-monitoring) [Malware Scanning](https://www.jkconcepts.at/en/website-security-glossary/#malware-scanning) **Suspect your website is infected?** [See immediate steps →](https://www.jkconcepts.at/en/wordpress-hacked/) Basics · Basic [#backend](https://www.jkconcepts.at/en/website-security-glossary/#backend) ### What is the backend? Backend · The server-side part of an application The backend handles business logic, data access, permissions and interfaces outside the visible browser interface. ### Technology, example and context #### Technical explanation Backend processes validate requests, coordinate services and databases and generate HTML or structured API responses. #### Example A contact backend checks inputs, limits abuse and stores an enquiry. #### Related terms [Frontend](https://www.jkconcepts.at/en/web-technology-glossary/#frontend) [Full Stack](https://www.jkconcepts.at/en/web-technology-glossary/#full-stack) [API](https://www.jkconcepts.at/en/web-technology-glossary/#api) [Database](https://www.jkconcepts.at/en/web-technology-glossary/#database) Operations & detection · Basic [#backup](https://www.jkconcepts.at/en/website-security-glossary/#backup) ### What is a backup? Backup · Restorable data copy A backup is a separate copy of data and configuration from which a system can be restored. ### Technology, example and context #### Technical explanation Reliable backups have suitable intervals, retention, access protection, off-site copies and regularly tested restore processes. #### Example A website’s files and database are backed up daily, with versions, to separate storage. #### Related terms [Disaster Recovery](https://www.jkconcepts.at/en/website-security-glossary/#disaster-recovery) [Ransomware](https://www.jkconcepts.at/en/website-security-glossary/#ransomware) [WordPress Hardening](https://www.jkconcepts.at/en/website-security-glossary/#wordpress-hardening) [Monitoring](https://www.jkconcepts.at/en/website-security-glossary/#monitoring) **Ongoing care for updates, backups and monitoring?** [See WordPress maintenance →](https://www.jkconcepts.at/en/wordpress-maintenance/) Attacks · Basic [#bot-attack](https://www.jkconcepts.at/en/website-security-glossary/#bot-attack) ### What is a bot attack? Bot Attack · Automated attack A bot attack automates abusive actions such as login attempts, scraping, spam or shopping basket manipulation. ### Technology, example and context #### Technical explanation Detection combines behavioural signals, rate limits, reputation and application-specific rules; IP blocks alone are often not enough. #### Example Automated programs test stolen account data against a shop login. #### Related terms [Bot Protection](https://www.jkconcepts.at/en/website-security-glossary/#bot-protection) [Brute Force](https://www.jkconcepts.at/en/website-security-glossary/#brute-force) [Credential Stuffing](https://www.jkconcepts.at/en/website-security-glossary/#credential-stuffing) [Rate Limiting](https://www.jkconcepts.at/en/website-security-glossary/#rate-limiting) Safeguards · Advanced [#bot-protection](https://www.jkconcepts.at/en/website-security-glossary/#bot-protection) ### What is bot protection? Bot Protection · Protection against automated abuse Bot protection detects and limits automated access without locking out welcome crawlers and real users across the board. ### Technology, example and context #### Technical explanation Signals include rates, behaviour, browser characteristics, reputation, account context and application-specific flows. #### Example A shop limits automated checkout attempts while still letting search engines crawl. #### Related terms [Bot Attack](https://www.jkconcepts.at/en/website-security-glossary/#bot-attack) [Rate Limiting](https://www.jkconcepts.at/en/website-security-glossary/#rate-limiting) [Web Application Firewall](https://www.jkconcepts.at/en/website-security-glossary/#waf) [Crawler & AI Crawler](https://www.jkconcepts.at/en/ai-glossary/#ai-crawler) Attacks · Basic [#brute-force](https://www.jkconcepts.at/en/website-security-glossary/#brute-force) ### What is a brute-force attack? Brute Force · Systematic trial and error A brute-force attack tries many possible credentials or keys automatically. ### Technology, example and context #### Technical explanation Rate limits, progressive delays, MFA, strong passwords, anomaly detection and safe lockout mechanisms form combined layers of protection. #### Example A bot sends thousands of password attempts against wp-login.php. #### Related terms [Credential Stuffing](https://www.jkconcepts.at/en/website-security-glossary/#credential-stuffing) [Rate Limiting](https://www.jkconcepts.at/en/website-security-glossary/#rate-limiting) [MFA / 2FA](https://www.jkconcepts.at/en/website-security-glossary/#mfa) [Bot Protection](https://www.jkconcepts.at/en/website-security-glossary/#bot-protection) **Hardening WordPress before something happens?** [See WordPress security →](https://www.jkconcepts.at/en/wordpress-security/) ## Terms starting with C Web basics · Basic [#cdn](https://www.jkconcepts.at/en/website-security-glossary/#cdn) ### What is a CDN? CDN · Content Delivery Network A CDN distributes and stores content across several locations so that it can be delivered closer to visitors. ### Technology, example and context #### Technical explanation Edge servers answer cacheable requests, often terminate TLS and can add protective functions such as DDoS defence or a WAF. #### Example Images and scripts of an Austrian website are loaded from regional edge locations for international visitors. #### Related terms [Cache](https://www.jkconcepts.at/en/web-technology-glossary/#cache) [Web Hosting](https://www.jkconcepts.at/en/web-technology-glossary/#webhosting) [DDoS](https://www.jkconcepts.at/en/website-security-glossary/#ddos) [Web Application Firewall](https://www.jkconcepts.at/en/website-security-glossary/#waf) Safeguards · Technical [#csp](https://www.jkconcepts.at/en/website-security-glossary/#csp) ### What is a content security policy? Content Security Policy · CSP A CSP limits the sources from which a page may load scripts, styles, images and other resources. ### Technology, example and context #### Technical explanation The HTTP policy works with directives and source expressions; nonces or hashes can mark specifically permitted inline code. #### Example script-src 'self' basically only allows scripts from the page’s own origin. #### Why does it matter? A carefully introduced CSP makes XSS harder, but can block legitimate features if misconfigured. #### Related terms [Security Headers](https://www.jkconcepts.at/en/website-security-glossary/#security-headers) [Cross-Site Scripting](https://www.jkconcepts.at/en/website-security-glossary/#xss) [Subresource Integrity](https://www.jkconcepts.at/en/website-security-glossary/#subresource-integrity) [HTTP Header](https://www.jkconcepts.at/en/website-security-glossary/#http-header) **Securing your website technically?** [See website security →](https://www.jkconcepts.at/en/wordpress-security/) Web basics · Basic [#cookie](https://www.jkconcepts.at/en/website-security-glossary/#cookie) ### What are cookies? Cookie · HTTP value stored by the browser A cookie is a small value that a website can set in the browser and have sent along with matching later requests. ### Technology, example and context #### Technical explanation Attributes such as Domain, Path, Expires, Secure, HttpOnly and SameSite limit lifetime and transmission. #### Example A random session identifier connects several requests to a logged-in session. #### Why does it matter? Cookies can be technically necessary or require consent and transparent privacy information. #### Related terms [Session](https://www.jkconcepts.at/en/website-security-glossary/#session) [SameSite Cookie](https://www.jkconcepts.at/en/website-security-glossary/#samesite-cookie) [HttpOnly](https://www.jkconcepts.at/en/website-security-glossary/#httponly) [Secure Cookie](https://www.jkconcepts.at/en/website-security-glossary/#secure-cookie) Safeguards · Technical [#cors](https://www.jkconcepts.at/en/website-security-glossary/#cors) ### What is CORS? CORS · Cross-Origin Resource Sharing CORS controls which other origins browsers may allow to access a server’s resources. ### Technology, example and context #### Technical explanation Servers set Access-Control-Allow-* headers; non-simple requests can trigger an OPTIONS preflight. CORS is not server-side authentication. #### Example An API only allows browser access from the frontend’s production domain. #### Related terms [HTTP Header](https://www.jkconcepts.at/en/website-security-glossary/#http-header) [API](https://www.jkconcepts.at/en/web-technology-glossary/#api) [CSRF](https://www.jkconcepts.at/en/website-security-glossary/#csrf) [Authentication](https://www.jkconcepts.at/en/website-security-glossary/#authentication) Attacks · Advanced [#credential-stuffing](https://www.jkconcepts.at/en/website-security-glossary/#credential-stuffing) ### What is credential stuffing? Credential Stuffing · Reuse of stolen credentials Credential stuffing automatically tests known combinations of email address and password on other services. ### Technology, example and context #### Technical explanation The attack exploits password reuse rather than a vulnerability in the target; MFA, passkeys, rate limits and leaked-credential checks help. #### Example Data from someone else’s data leak is tested against a shop’s customer login. #### Related terms [Brute Force](https://www.jkconcepts.at/en/website-security-glossary/#brute-force) [Phishing](https://www.jkconcepts.at/en/website-security-glossary/#phishing) [MFA / 2FA](https://www.jkconcepts.at/en/website-security-glossary/#mfa) [Passkey](https://www.jkconcepts.at/en/website-security-glossary/#passkey) Attacks · Advanced [#xss](https://www.jkconcepts.at/en/website-security-glossary/#xss) ### What is cross-site scripting? Cross-Site Scripting · XSS XSS allows untrusted content to be executed as active code in other users’ browsers. ### Technology, example and context #### Technical explanation Context-specific output encoding, safe DOM APIs, sanitising and a restrictive CSP form the central layers of protection. #### Example An unfiltered comment is output as HTML and contains an executable script element. #### Related terms [Content Security Policy](https://www.jkconcepts.at/en/website-security-glossary/#csp) [HttpOnly](https://www.jkconcepts.at/en/website-security-glossary/#httponly) [Input Validation](https://www.jkconcepts.at/en/website-security-glossary/#input-validation) [Session Hijacking](https://www.jkconcepts.at/en/website-security-glossary/#session-hijacking) Attacks · Advanced [#csrf](https://www.jkconcepts.at/en/website-security-glossary/#csrf) ### What is CSRF? CSRF · Cross-Site Request Forgery CSRF makes a logged-in browser send a state-changing request without the user intending to. ### Technology, example and context #### Technical explanation Synchroniser tokens, SameSite cookies, origin checks and safe HTTP methods reduce the risk; XSS can bypass many CSRF protections. #### Example A third-party page triggers an account change in the background on a service where you are already logged in. #### Related terms [Cookie](https://www.jkconcepts.at/en/website-security-glossary/#cookie) [SameSite Cookie](https://www.jkconcepts.at/en/website-security-glossary/#samesite-cookie) [Cross-Site Scripting](https://www.jkconcepts.at/en/website-security-glossary/#xss) [WordPress Nonce](https://www.jkconcepts.at/en/website-security-glossary/#wordpress-nonce) Basics · Advanced [#cve](https://www.jkconcepts.at/en/website-security-glossary/#cve) ### What is a CVE? CVE · Common Vulnerabilities and Exposures A CVE ID uniquely identifies a specific, publicly recorded security vulnerability. ### Technology, example and context #### Technical explanation The identifier makes it referenceable, while the description, affected versions, rating and countermeasures come from advisories and databases. #### Example A vendor advisory names a CVE and the first patched plugin version. #### Related terms [Vulnerability](https://www.jkconcepts.at/en/website-security-glossary/#vulnerability) [CWE](https://www.jkconcepts.at/en/website-security-glossary/#cwe) [CVSS](https://www.jkconcepts.at/en/website-security-glossary/#cvss) [Security Patch](https://www.jkconcepts.at/en/website-security-glossary/#patch) Basics · Technical [#cvss](https://www.jkconcepts.at/en/website-security-glossary/#cvss) ### What is a CVSS score? CVSS · Common Vulnerability Scoring System CVSS describes the technical characteristics and severity of a vulnerability as a standardised vector and numerical value. ### Technology, example and context #### Technical explanation The base score alone does not determine the operational risk; exposure, affected data, active exploitation and existing controls belong in the prioritisation. #### Example A highly rated vulnerability in a deactivated component may be prioritised differently from an actively exploited medium one. #### Related terms [CVE](https://www.jkconcepts.at/en/website-security-glossary/#cve) [Vulnerability](https://www.jkconcepts.at/en/website-security-glossary/#vulnerability) [Exploit](https://www.jkconcepts.at/en/website-security-glossary/#exploit) [Security Patch](https://www.jkconcepts.at/en/website-security-glossary/#patch) Basics · Technical [#cwe](https://www.jkconcepts.at/en/website-security-glossary/#cwe) ### What is CWE? CWE · Common Weakness Enumeration CWE classifies general types of software and hardware weaknesses. ### Technology, example and context #### Technical explanation A CVE typically describes a specific vulnerability in a product, a CWE the underlying error pattern. #### Example SQL injection is a type of weakness; specific affected plugin versions may receive CVE IDs. #### Related terms [CVE](https://www.jkconcepts.at/en/website-security-glossary/#cve) [Vulnerability](https://www.jkconcepts.at/en/website-security-glossary/#vulnerability) [SQL Injection](https://www.jkconcepts.at/en/website-security-glossary/#sql-injection) [Cross-Site Scripting](https://www.jkconcepts.at/en/website-security-glossary/#xss) Basics · Basic [#cybersecurity](https://www.jkconcepts.at/en/website-security-glossary/#cybersecurity) ### What is cybersecurity? Cybersecurity · Information and IT security Cybersecurity protects digital systems, data and services against attacks, misuse and unintentional damage. ### Technology, example and context #### Technical explanation The field covers prevention, detection, response and recovery across identities, applications, networks, devices and processes. #### Example Access controls, secure configuration, logging and emergency plans reduce the risk together. #### Related terms [Website Security](https://www.jkconcepts.at/en/website-security-glossary/#website-security) [Zero Trust](https://www.jkconcepts.at/en/website-security-glossary/#zero-trust) [Monitoring](https://www.jkconcepts.at/en/website-security-glossary/#monitoring) [Disaster Recovery](https://www.jkconcepts.at/en/website-security-glossary/#disaster-recovery) ## Terms starting with D AI security · Advanced [#datenschutz](https://www.jkconcepts.at/en/website-security-glossary/#datenschutz) ### What does Data Protection mean? Data Protection · Protection of personal data Rules and measures for the lawful, purpose-bound and secure processing of personal data. ### Technology, example and context #### Example Before using an AI service, the purpose, necessary data, provider, storage location, contracts and deletion periods are checked. #### Why does it matter? AI doesn’t change the principles of data protection. What matters is the specific data flow, not the label of the tool used. #### Related terms [PII](https://www.jkconcepts.at/en/ai-glossary/#pii) [Pseudonymisation](https://www.jkconcepts.at/en/ai-glossary/#pseudonymisierung) [Cloud AI](https://www.jkconcepts.at/en/ai-glossary/#cloud-ai) Attacks · Basic [#ddos](https://www.jkconcepts.at/en/website-security-glossary/#ddos) ### What is a DDoS attack? DDoS · Distributed Denial of Service A DDoS attack tries to overload a service with distributed requests or data streams. ### Technology, example and context #### Technical explanation Protection is implemented at network, protocol and application level and often needs upstream anycast, CDN or scrubbing infrastructure. #### Example Many compromised devices send requests to an online shop at the same time. #### Related terms [CDN](https://www.jkconcepts.at/en/website-security-glossary/#cdn) [Rate Limiting](https://www.jkconcepts.at/en/website-security-glossary/#rate-limiting) [Bot Attack](https://www.jkconcepts.at/en/website-security-glossary/#bot-attack) [Monitoring](https://www.jkconcepts.at/en/website-security-glossary/#monitoring) Attacks · Technical [#dependency-confusion](https://www.jkconcepts.at/en/website-security-glossary/#dependency-confusion) ### What is dependency confusion? Dependency Confusion · Mixing up internal and public packages Dependency confusion tricks a build system into loading a malicious public package instead of an intended internal dependency. ### Technology, example and context #### Technical explanation Unique namespaces, fixed registries, lockfiles and controlled resolution prevent surprising changes of source. #### Example A publicly released package has the same name as an internal library and a higher version number. #### Related terms [Software Supply Chain Attack](https://www.jkconcepts.at/en/website-security-glossary/#supply-chain-attack) [Subresource Integrity](https://www.jkconcepts.at/en/website-security-glossary/#subresource-integrity) [Least Privilege](https://www.jkconcepts.at/en/website-security-glossary/#least-privilege) Operations & detection · Advanced [#disaster-recovery](https://www.jkconcepts.at/en/website-security-glossary/#disaster-recovery) ### What is disaster recovery? Disaster Recovery · Planned recovery after an outage Disaster recovery describes prepared processes for restoring systems and data after serious disruptions. ### Technology, example and context #### Technical explanation Targets such as RTO and RPO, responsibilities, alternative infrastructure, key material and tested runbooks determine how restorable a system really is. #### Example After a server failure, the website is started on new infrastructure from a verified backup. #### Related terms [Backup](https://www.jkconcepts.at/en/website-security-glossary/#backup) [Monitoring](https://www.jkconcepts.at/en/website-security-glossary/#monitoring) [Logging](https://www.jkconcepts.at/en/website-security-glossary/#logging) [Ransomware](https://www.jkconcepts.at/en/website-security-glossary/#ransomware) ## Terms starting with E Safeguards · Basic [#encryption](https://www.jkconcepts.at/en/website-security-glossary/#encryption) ### What is encryption? Encryption · Making data unreadable without a key Encryption uses a key to turn data into a form that cannot be read directly and is reversible in principle. ### Technology, example and context #### Technical explanation Symmetric methods use the same secret key, asymmetric ones a matching pair of public and private keys. #### Example TLS encrypts data in transit between browser and server. #### Related terms [Hashing](https://www.jkconcepts.at/en/website-security-glossary/#hashing) [TLS](https://www.jkconcepts.at/en/website-security-glossary/#tls) [HTTPS](https://www.jkconcepts.at/en/website-security-glossary/#https) [TLS Certificate](https://www.jkconcepts.at/en/website-security-glossary/#certificate) Basics · Advanced [#exploit](https://www.jkconcepts.at/en/website-security-glossary/#exploit) ### What is an exploit? Exploit · Taking advantage of a vulnerability An exploit is a method or piece of code that deliberately takes advantage of a vulnerability. ### Technology, example and context #### Technical explanation The impact ranges from information disclosure through privilege escalation to arbitrary code execution; prerequisites can be a version, configuration or user interaction. #### Example A specially crafted request triggers an error and bypasses an access control. #### Related terms [Vulnerability](https://www.jkconcepts.at/en/website-security-glossary/#vulnerability) [Zero-Day](https://www.jkconcepts.at/en/website-security-glossary/#zero-day) [Remote Code Execution](https://www.jkconcepts.at/en/website-security-glossary/#rce) [Privilege Escalation](https://www.jkconcepts.at/en/website-security-glossary/#privilege-escalation) ## Terms starting with F Attacks · Technical [#file-inclusion](https://www.jkconcepts.at/en/website-security-glossary/#file-inclusion) ### What are LFI and RFI? File Inclusion · Unsafe inclusion of files File inclusion arises when untrusted input determines which file an application loads or executes. ### Technology, example and context #### Technical explanation LFI targets local sources, RFI remote ones; fixed mappings instead of dynamic paths and minimal runtime permissions reduce the risk. #### Example A template parameter is passed unchecked to a server-side include function. #### Related terms [Path Traversal](https://www.jkconcepts.at/en/website-security-glossary/#path-traversal) [Remote Code Execution](https://www.jkconcepts.at/en/website-security-glossary/#rce) [Input Validation](https://www.jkconcepts.at/en/website-security-glossary/#input-validation) Operations & detection · Advanced [#file-integrity-monitoring](https://www.jkconcepts.at/en/website-security-glossary/#file-integrity-monitoring) ### What is file integrity monitoring? File Integrity Monitoring · Monitoring file changes File integrity monitoring detects unexpected changes to monitored files. ### Technology, example and context #### Technical explanation Comparisons use hashes, known vendor versions or controlled baselines; legitimate deployments must be distinguishable from suspicious changes. #### Example An alert reports a new PHP file in an upload directory. #### Related terms [Malware](https://www.jkconcepts.at/en/website-security-glossary/#malware) [Backdoor](https://www.jkconcepts.at/en/website-security-glossary/#backdoor) [Logging](https://www.jkconcepts.at/en/website-security-glossary/#logging) [WordPress Hardening](https://www.jkconcepts.at/en/website-security-glossary/#wordpress-hardening) **Securing your website technically?** [See website security →](https://www.jkconcepts.at/en/wordpress-security/) Safeguards · Basic [#firewall](https://www.jkconcepts.at/en/website-security-glossary/#firewall) ### What is a firewall? Firewall · Control point for network traffic A firewall allows or blocks network traffic based on defined rules. ### Technology, example and context #### Technical explanation Depending on the layer, addresses, ports, connection states, protocols or application characteristics are evaluated. #### Example A database port can only be reached from the internal application network. #### Related terms [Web Application Firewall](https://www.jkconcepts.at/en/website-security-glossary/#waf) [IP Blocking](https://www.jkconcepts.at/en/website-security-glossary/#ip-blocking) [Least Privilege](https://www.jkconcepts.at/en/website-security-glossary/#least-privilege) [Zero Trust](https://www.jkconcepts.at/en/website-security-glossary/#zero-trust) ## Terms starting with H Safeguards · Advanced [#hashing](https://www.jkconcepts.at/en/website-security-glossary/#hashing) ### What is hashing? Hashing · One-way mapping of data Hashing produces a fixed-length value from data, with no intended way of reversing it. ### Technology, example and context #### Technical explanation Passwords need slow, memory-intensive methods with an individual salt; fast checksums such as SHA-256 alone are unsuitable for this. #### Example A login compares an Argon2id hash instead of a stored plain-text password. #### Related terms [Encryption](https://www.jkconcepts.at/en/website-security-glossary/#encryption) [Authentication](https://www.jkconcepts.at/en/website-security-glossary/#authentication) [WordPress Security Keys](https://www.jkconcepts.at/en/website-security-glossary/#wordpress-security-keys) Safeguards · Advanced [#hsts](https://www.jkconcepts.at/en/website-security-glossary/#hsts) ### What is HSTS? HSTS · HTTP Strict Transport Security HSTS instructs browsers to access a domain only via HTTPS for a defined period. ### Technology, example and context #### Technical explanation The Strict-Transport-Security header can include subdomains; preloading also reduces the risk on the very first visit. #### Example A browser locally replaces a later http request with https. #### Related terms [HTTPS](https://www.jkconcepts.at/en/website-security-glossary/#https) [TLS](https://www.jkconcepts.at/en/website-security-glossary/#tls) [Security Headers](https://www.jkconcepts.at/en/website-security-glossary/#security-headers) [TLS Certificate](https://www.jkconcepts.at/en/website-security-glossary/#certificate) Web basics · Basic [#http-500](https://www.jkconcepts.at/en/website-security-glossary/#http-500) ### What does HTTP 500 mean? HTTP 500 · Internal Server Error The status code 500 reports an unexpected server-side error while processing a request. ### Technology, example and context #### Technical explanation The public response is deliberately generic; specific causes are found in application and server logs and can range from code errors to resource problems. #### Example A faulty plugin triggers an unhandled PHP exception. #### Related terms [Logging](https://www.jkconcepts.at/en/website-security-glossary/#logging) [Monitoring](https://www.jkconcepts.at/en/website-security-glossary/#monitoring) [Backend](https://www.jkconcepts.at/en/website-security-glossary/#backend) [Web Server](https://www.jkconcepts.at/en/website-security-glossary/#webserver) **Is your website showing errors or down?** [See WordPress help →](https://www.jkconcepts.at/en/wordpress-help/) Web basics · Advanced [#http-header](https://www.jkconcepts.at/en/website-security-glossary/#http-header) ### What are HTTP headers? HTTP Header · Metadata of an HTTP message HTTP headers carry additional information about a request or response. ### Technology, example and context #### Technical explanation Headers control, among other things, content type, caching, authentication, compression, cookies, CORS and browser security rules. #### Example Content-Type: application/json marks a JSON response. #### Related terms [HTTP](https://www.jkconcepts.at/en/web-technology-glossary/#http) [Cache-Control](https://www.jkconcepts.at/en/web-technology-glossary/#cache-control) [Security Headers](https://www.jkconcepts.at/en/website-security-glossary/#security-headers) [CORS](https://www.jkconcepts.at/en/website-security-glossary/#cors) Identity & access · Advanced [#httponly](https://www.jkconcepts.at/en/website-security-glossary/#httponly) ### What does HttpOnly mean for cookies? HttpOnly · Cookie protection against JavaScript access HttpOnly prevents JavaScript in the browser from reading a cookie’s value directly. ### Technology, example and context #### Technical explanation The browser still sends the cookie automatically with matching HTTP requests; CSRF protection and XSS prevention therefore remain necessary. #### Example The session ID is not visible to document.cookie. #### Related terms [Cookie](https://www.jkconcepts.at/en/website-security-glossary/#cookie) [Session Hijacking](https://www.jkconcepts.at/en/website-security-glossary/#session-hijacking) [Cross-Site Scripting](https://www.jkconcepts.at/en/website-security-glossary/#xss) [Secure Cookie](https://www.jkconcepts.at/en/website-security-glossary/#secure-cookie) Web basics · Basic [#https](https://www.jkconcepts.at/en/website-security-glossary/#https) ### What is HTTPS? HTTPS · HTTP over TLS HTTPS uses TLS to protect the connection between client and server against simple eavesdropping and tampering. ### Technology, example and context #### Technical explanation After the TLS handshake, HTTP messages are transmitted encrypted and authenticated; the certificate binds the public key to a host name. #### Example A login form does not transmit credentials as unencrypted plain text over the network. #### Why does it matter? HTTPS is a basic requirement for secure forms, modern browser features and trustworthy website operation. #### Related terms [TLS](https://www.jkconcepts.at/en/website-security-glossary/#tls) [HTTP](https://www.jkconcepts.at/en/web-technology-glossary/#http) [HSTS](https://www.jkconcepts.at/en/website-security-glossary/#hsts) [TLS Certificate](https://www.jkconcepts.at/en/website-security-glossary/#certificate) **Securing your website technically?** [See website security →](https://www.jkconcepts.at/en/wordpress-security/) ## Terms starting with I Attacks · Advanced [#injection](https://www.jkconcepts.at/en/website-security-glossary/#injection) ### What is an injection attack? Injection · Injecting commands or syntax In an injection, data is processed in such a way that it unintentionally acts as commands or program syntax. ### Technology, example and context #### Technical explanation Secure APIs, context-aware encoding, parameterisation, strict separation of data and code and minimal permissions reduce the risk. #### Example SQL, operating system or template syntax reaches an interpreter through unsecured input. #### Related terms [SQL Injection](https://www.jkconcepts.at/en/website-security-glossary/#sql-injection) [Cross-Site Scripting](https://www.jkconcepts.at/en/website-security-glossary/#xss) [Remote Code Execution](https://www.jkconcepts.at/en/website-security-glossary/#rce) [Input Validation](https://www.jkconcepts.at/en/website-security-glossary/#input-validation) Safeguards · Advanced [#input-validation](https://www.jkconcepts.at/en/website-security-glossary/#input-validation) ### What is input validation? Input Validation · Checking input data Input validation checks whether data matches the expected types, formats, lengths and business rules. ### Technology, example and context #### Technical explanation The decisive check happens at the trust boundary on the server; it does not replace context-specific encoding or parameterised APIs. #### Example An ID must be a positive integer and refer to a record the user is authorised to access. #### Related terms [Injection](https://www.jkconcepts.at/en/website-security-glossary/#injection) [SQL Injection](https://www.jkconcepts.at/en/website-security-glossary/#sql-injection) [Cross-Site Scripting](https://www.jkconcepts.at/en/website-security-glossary/#xss) [Authorisation](https://www.jkconcepts.at/en/website-security-glossary/#authorization) Safeguards · Basic [#ip-blocking](https://www.jkconcepts.at/en/website-security-glossary/#ip-blocking) ### What does IP blocking mean? IP Blocking · Blocking network addresses IP blocking refuses requests from selected IP addresses or networks. ### Technology, example and context #### Technical explanation The measure is coarse because addresses can be shared, dynamic or changed via proxies; it should be part of multi-layered detection. #### Example A clearly abusive host is temporarily blocked at the web server. #### Related terms [Firewall](https://www.jkconcepts.at/en/website-security-glossary/#firewall) [Bot Protection](https://www.jkconcepts.at/en/website-security-glossary/#bot-protection) [Rate Limiting](https://www.jkconcepts.at/en/website-security-glossary/#rate-limiting) ## Terms starting with L Identity & access · Basic [#least-privilege](https://www.jkconcepts.at/en/website-security-glossary/#least-privilege) ### What does least privilege mean? Least Privilege · Principle of minimal permissions Least privilege grants only the permissions that are actually needed for a specific task. ### Technology, example and context #### Technical explanation The principle applies to users, processes, databases, API tokens and networks and limits the impact of compromised components. #### Example The website connects to a database account without global administrator rights. #### Related terms [Authorisation](https://www.jkconcepts.at/en/website-security-glossary/#authorization) [Zero Trust](https://www.jkconcepts.at/en/website-security-glossary/#zero-trust) [Privilege Escalation](https://www.jkconcepts.at/en/website-security-glossary/#privilege-escalation) [API](https://www.jkconcepts.at/en/web-technology-glossary/#api) Operations & detection · Basic [#logging](https://www.jkconcepts.at/en/website-security-glossary/#logging) ### What does logging mean? Logging · Recording events Logging records technical and security-relevant events for diagnosis, traceability and detection. ### Technology, example and context #### Technical explanation Good logs contain the time, event type and necessary context, avoid sensitive content and are protected against unnoticed tampering. #### Example Failed logins are logged with the account, time and approximate origin. #### Related terms [Monitoring](https://www.jkconcepts.at/en/website-security-glossary/#monitoring) [HTTP 500](https://www.jkconcepts.at/en/website-security-glossary/#http-500) [File Integrity Monitoring](https://www.jkconcepts.at/en/website-security-glossary/#file-integrity-monitoring) [Website Security](https://www.jkconcepts.at/en/website-security-glossary/#website-security) ## Terms starting with M Basics · Basic [#malware](https://www.jkconcepts.at/en/website-security-glossary/#malware) ### What is malware? Malware · Malicious software Malware is software or injected code with a malicious or unauthorised function. ### Technology, example and context #### Technical explanation On websites, malware modifies files or databases, creates access, redirects visitors, sends spam or loads further components. #### Example A compromised plugin injects a script that redirects visitors to fraudulent sites. #### Why does it matter? A clean-up has to deal not only with visible files, but also with the entry point, persistence and compromised credentials. #### Related terms [Backdoor](https://www.jkconcepts.at/en/website-security-glossary/#backdoor) [Malware Scanning](https://www.jkconcepts.at/en/website-security-glossary/#malware-scanning) [File Integrity Monitoring](https://www.jkconcepts.at/en/website-security-glossary/#file-integrity-monitoring) [Website Security](https://www.jkconcepts.at/en/website-security-glossary/#website-security) **Suspect your website is infected?** [See immediate steps →](https://www.jkconcepts.at/en/wordpress-hacked/) Operations & detection · Basic [#malware-scanning](https://www.jkconcepts.at/en/website-security-glossary/#malware-scanning) ### What is malware scanning? Malware Scanning · Automated search for malicious code Malware scanning examines files, content or behaviour for signs of malicious code. ### Technology, example and context #### Technical explanation Signatures, heuristics, reputation data and file comparisons complement each other; no single scan proves that a system is clean. #### Example A scanner finds a known web shell signature in a modified plugin file. #### Related terms [Malware](https://www.jkconcepts.at/en/website-security-glossary/#malware) [Backdoor](https://www.jkconcepts.at/en/website-security-glossary/#backdoor) [File Integrity Monitoring](https://www.jkconcepts.at/en/website-security-glossary/#file-integrity-monitoring) [Monitoring](https://www.jkconcepts.at/en/website-security-glossary/#monitoring) **Suspect your website is infected?** [See immediate steps →](https://www.jkconcepts.at/en/wordpress-hacked/) Identity & access · Basic [#mfa](https://www.jkconcepts.at/en/website-security-glossary/#mfa) ### What is MFA? MFA / 2FA · Multi-factor authentication MFA requires several independent proofs for a login. ### Technology, example and context #### Technical explanation Factors typically come from knowledge, possession or inherence; phishing-resistant methods such as WebAuthn are stronger than transferable one-time codes. #### Example In addition to the password, an administrator confirms the login with a security key. #### Related terms [Authentication](https://www.jkconcepts.at/en/website-security-glossary/#authentication) [TOTP](https://www.jkconcepts.at/en/website-security-glossary/#totp) [Passkey](https://www.jkconcepts.at/en/website-security-glossary/#passkey) [WebAuthn](https://www.jkconcepts.at/en/website-security-glossary/#webauthn) Operations & detection · Basic [#monitoring](https://www.jkconcepts.at/en/website-security-glossary/#monitoring) ### What is website monitoring? Monitoring · Ongoing system monitoring Monitoring observes the availability, performance, errors and selected security signals of a system. ### Technology, example and context #### Technical explanation Metrics, synthetic checks and log signals need thresholds, alerting paths and responsible responses so that data turns into action. #### Example An alert is triggered when the website cannot be reached or errors rise sharply. #### Related terms [Logging](https://www.jkconcepts.at/en/website-security-glossary/#logging) [Backup](https://www.jkconcepts.at/en/website-security-glossary/#backup) [File Integrity Monitoring](https://www.jkconcepts.at/en/website-security-glossary/#file-integrity-monitoring) [Disaster Recovery](https://www.jkconcepts.at/en/website-security-glossary/#disaster-recovery) **Ongoing care for updates, backups and monitoring?** [See WordPress maintenance →](https://www.jkconcepts.at/en/wordpress-maintenance/) ## Terms starting with P Identity & access · Basic [#passkey](https://www.jkconcepts.at/en/website-security-glossary/#passkey) ### What is a passkey? Passkey · Phishing-resistant login with a key pair A passkey logs a user in with a cryptographic key pair instead of a shared password. ### Technology, example and context #### Technical explanation The private key stays on the device or in a protected sync system; the server only stores the public key and a credential ID. #### Example A login is confirmed with the device PIN or biometrics without sending a password to the website. #### Related terms [WebAuthn](https://www.jkconcepts.at/en/website-security-glossary/#webauthn) [Authentication](https://www.jkconcepts.at/en/website-security-glossary/#authentication) [MFA / 2FA](https://www.jkconcepts.at/en/website-security-glossary/#mfa) [Phishing](https://www.jkconcepts.at/en/website-security-glossary/#phishing) Attacks · Technical [#path-traversal](https://www.jkconcepts.at/en/website-security-glossary/#path-traversal) ### What is path traversal? Path Traversal · Unauthorised file path access Path traversal manipulates file paths in order to access files outside a permitted directory. ### Technology, example and context #### Technical explanation Applications should not use user input directly as paths, should check canonical targets and limit file access to defined roots. #### Example A download function accepts../ sequences and delivers a configuration file. #### Related terms [File Inclusion](https://www.jkconcepts.at/en/website-security-glossary/#file-inclusion) [Input Validation](https://www.jkconcepts.at/en/website-security-glossary/#input-validation) [Least Privilege](https://www.jkconcepts.at/en/website-security-glossary/#least-privilege) Basics · Basic [#phishing](https://www.jkconcepts.at/en/website-security-glossary/#phishing) ### What is phishing? Phishing · Deception to obtain sensitive information Phishing fakes trustworthy communication in order to obtain credentials, payments or other sensitive actions. ### Technology, example and context #### Technical explanation Attackers combine social engineering with cloned login pages, prepared attachments, OAuth grants or fraudulent payment instructions. #### Example A fake hosting message asks you to log in on a domain with a similar spelling. #### Related terms [Social Engineering](https://www.jkconcepts.at/en/website-security-glossary/#social-engineering) [Credential Stuffing](https://www.jkconcepts.at/en/website-security-glossary/#credential-stuffing) [MFA / 2FA](https://www.jkconcepts.at/en/website-security-glossary/#mfa) [Passkey](https://www.jkconcepts.at/en/website-security-glossary/#passkey) WordPress security · Basic [#plugin-vulnerability](https://www.jkconcepts.at/en/website-security-glossary/#plugin-vulnerability) ### What is a plugin vulnerability? Plugin Vulnerability · Weakness in an extension A plugin vulnerability is an exploitable weakness in an extension or its configuration. ### Technology, example and context #### Technical explanation The risk depends on reachability, required permissions, active use, available exploits and possible impact. #### Example An upload function does not check the file type and permissions sufficiently. #### Related terms [Vulnerability](https://www.jkconcepts.at/en/website-security-glossary/#vulnerability) [Security Patch](https://www.jkconcepts.at/en/website-security-glossary/#patch) [WordPress Hardening](https://www.jkconcepts.at/en/website-security-glossary/#wordpress-hardening) [Software Supply Chain Attack](https://www.jkconcepts.at/en/website-security-glossary/#supply-chain-attack) **Ongoing care for updates, backups and monitoring?** [See WordPress maintenance →](https://www.jkconcepts.at/en/wordpress-maintenance/) Attacks · Advanced [#privilege-escalation](https://www.jkconcepts.at/en/website-security-glossary/#privilege-escalation) ### What is privilege escalation? Privilege Escalation · Gaining more permissions Privilege escalation gives a user or process more permissions than intended. ### Technology, example and context #### Technical explanation Vertical escalation reaches higher roles, horizontal escalation accesses other people’s resources at the same level; server-side authorisation is decisive. #### Example A normal user changes a URL and reaches an action intended only for administrators. #### Related terms [Authorisation](https://www.jkconcepts.at/en/website-security-glossary/#authorization) [Least Privilege](https://www.jkconcepts.at/en/website-security-glossary/#least-privilege) [Vulnerability](https://www.jkconcepts.at/en/website-security-glossary/#vulnerability) [Remote Code Execution](https://www.jkconcepts.at/en/website-security-glossary/#rce) AI security · Advanced [#prompt-injection](https://www.jkconcepts.at/en/website-security-glossary/#prompt-injection) ### What does Prompt Injection mean? Prompt Injection · Manipulation through injected instructions An attack in which malicious instructions in inputs or in content that is read are meant to manipulate the AI system. ### Technology, example and context #### Example A document contains hidden instructions intended to make an agent reveal data or call a tool. #### Why does it matter? As soon as models read external content or use tools, system prompts are not enough; permissions and actions must be limited technically. #### Related terms [Jailbreak](https://www.jkconcepts.at/en/ai-glossary/#jailbreak) [System Prompt](https://www.jkconcepts.at/en/ai-glossary/#system-prompt) [AI Guardrails](https://www.jkconcepts.at/en/website-security-glossary/#ai-guardrails) ## Terms starting with R Basics · Basic [#ransomware](https://www.jkconcepts.at/en/website-security-glossary/#ransomware) ### What is ransomware? Ransomware · Extortion software Ransomware encrypts or withholds data and systems in order to extort a payment. ### Technology, example and context #### Technical explanation Attacks often combine credential theft, lateral movement, data exfiltration and targeted sabotage of backups. #### Example A compromised administrator account is used to encrypt server data and any backups that can be reached. #### Related terms [Malware](https://www.jkconcepts.at/en/website-security-glossary/#malware) [Phishing](https://www.jkconcepts.at/en/website-security-glossary/#phishing) [Backup](https://www.jkconcepts.at/en/website-security-glossary/#backup) [Disaster Recovery](https://www.jkconcepts.at/en/website-security-glossary/#disaster-recovery) Safeguards · Advanced [#rate-limiting](https://www.jkconcepts.at/en/website-security-glossary/#rate-limiting) ### What is rate limiting? Rate Limiting · Limiting requests Rate limiting restricts how many actions are allowed within a period of time. ### Technology, example and context #### Technical explanation Limits can apply per account, token, IP, route or risk signal; distributed systems need a shared or consistent counter. #### Example After several failed logins, further attempts are delayed step by step. #### Related terms [Brute Force](https://www.jkconcepts.at/en/website-security-glossary/#brute-force) [Bot Protection](https://www.jkconcepts.at/en/website-security-glossary/#bot-protection) [API](https://www.jkconcepts.at/en/web-technology-glossary/#api) [DDoS](https://www.jkconcepts.at/en/website-security-glossary/#ddos) Attacks · Technical [#rce](https://www.jkconcepts.at/en/website-security-glossary/#rce) ### What is remote code execution? Remote Code Execution · RCE Remote code execution makes it possible to run an attacker’s code on a remote system. ### Technology, example and context #### Technical explanation RCE can arise from injection, insecure deserialisation, file uploads, memory corruption or compromised dependencies and usually has a high impact. #### Example A vulnerable extension executes an injected system command with the web server’s permissions. #### Related terms [Exploit](https://www.jkconcepts.at/en/website-security-glossary/#exploit) [Injection](https://www.jkconcepts.at/en/website-security-glossary/#injection) [File Inclusion](https://www.jkconcepts.at/en/website-security-glossary/#file-inclusion) [Least Privilege](https://www.jkconcepts.at/en/website-security-glossary/#least-privilege) Web basics · Basic [#robots-txt](https://www.jkconcepts.at/en/website-security-glossary/#robots-txt) ### What is robots.txt? robots.txt · Crawler control file robots.txt gives cooperating crawlers rules for fetching certain areas of a website. ### Technology, example and context #### Technical explanation The file lives at the origin under /robots.txt; Disallow does not prevent access and is no reliable protection against indexing or attackers. #### Example Internal search results are excluded from crawling by search engine bots. #### Related terms [XML Sitemap](https://www.jkconcepts.at/en/web-technology-glossary/#sitemap) [Crawler & AI Crawler](https://www.jkconcepts.at/en/ai-glossary/#ai-crawler) [Canonical URL](https://www.jkconcepts.at/en/web-technology-glossary/#canonical-url) ## Terms starting with S Identity & access · Technical [#samesite-cookie](https://www.jkconcepts.at/en/website-security-glossary/#samesite-cookie) ### What does SameSite mean for cookies? SameSite Cookie · Limiting cross-site cookie transmission SameSite controls when a browser sends cookies with requests from a different site context. ### Technology, example and context #### Technical explanation Strict, Lax and None have different rules for navigation and embedding; SameSite=None requires Secure. #### Example A Lax session cookie reduces many simple CSRF scenarios without preventing normal link navigation. #### Related terms [Cookie](https://www.jkconcepts.at/en/website-security-glossary/#cookie) [CSRF](https://www.jkconcepts.at/en/website-security-glossary/#csrf) [Secure Cookie](https://www.jkconcepts.at/en/website-security-glossary/#secure-cookie) [HttpOnly](https://www.jkconcepts.at/en/website-security-glossary/#httponly) Identity & access · Advanced [#secure-cookie](https://www.jkconcepts.at/en/website-security-glossary/#secure-cookie) ### What does Secure mean for cookies? Secure Cookie · Cookie sent only over HTTPS The Secure attribute ensures that a cookie is only sent over encrypted HTTPS connections. ### Technology, example and context #### Technical explanation It doesn’t protect against client-side reading and should be combined for sensitive cookies with HttpOnly, SameSite and narrow domain and path limits. #### Example A session cookie is never transmitted over an unencrypted HTTP connection. #### Related terms [Cookie](https://www.jkconcepts.at/en/website-security-glossary/#cookie) [HTTPS](https://www.jkconcepts.at/en/website-security-glossary/#https) [HttpOnly](https://www.jkconcepts.at/en/website-security-glossary/#httponly) [SameSite Cookie](https://www.jkconcepts.at/en/website-security-glossary/#samesite-cookie) Safeguards · Advanced [#security-headers](https://www.jkconcepts.at/en/website-security-glossary/#security-headers) ### What are security headers? Security Headers · HTTP security headers Security headers give the browser additional security rules for a website. ### Technology, example and context #### Technical explanation CSP, HSTS, frame-ancestors, Referrer-Policy and other headers limit loading sources, protocol downgrades, embedding and the sharing of information. #### Example A CSP prevents arbitrary third-party scripts from being executed on a page. #### Related terms [Content Security Policy](https://www.jkconcepts.at/en/website-security-glossary/#csp) [HSTS](https://www.jkconcepts.at/en/website-security-glossary/#hsts) [HTTP Header](https://www.jkconcepts.at/en/website-security-glossary/#http-header) [Cross-Site Scripting](https://www.jkconcepts.at/en/website-security-glossary/#xss) **Securing your website technically?** [See website security →](https://www.jkconcepts.at/en/wordpress-security/) Safeguards · Basic [#patch](https://www.jkconcepts.at/en/website-security-glossary/#patch) ### What is a security patch? Security Patch · Security update A security patch is a change that fixes known security problems or makes exploiting them harder. ### Technology, example and context #### Technical explanation Before installing, dependencies, compatibility, backups and a way back should be checked; delayed patches widen the window of attack. #### Example A plugin update closes a published access control vulnerability. #### Related terms [Vulnerability](https://www.jkconcepts.at/en/website-security-glossary/#vulnerability) [CVE](https://www.jkconcepts.at/en/website-security-glossary/#cve) [Backup](https://www.jkconcepts.at/en/website-security-glossary/#backup) [WordPress Hardening](https://www.jkconcepts.at/en/website-security-glossary/#wordpress-hardening) **Ongoing care for updates, backups and monitoring?** [See WordPress maintenance →](https://www.jkconcepts.at/en/wordpress-maintenance/) Web basics · Advanced [#session](https://www.jkconcepts.at/en/website-security-glossary/#session) ### What is a session? Session · Server-side session state A session keeps related user requests in a shared state across several page views. ### Technology, example and context #### Technical explanation Usually the server stores the state and the browser only sends a random session ID in a protected cookie. #### Example After login, the server recognises the logged-in user from the session ID. #### Related terms [Cookie](https://www.jkconcepts.at/en/website-security-glossary/#cookie) [Authentication](https://www.jkconcepts.at/en/website-security-glossary/#authentication) [Session Hijacking](https://www.jkconcepts.at/en/website-security-glossary/#session-hijacking) [Backend](https://www.jkconcepts.at/en/website-security-glossary/#backend) Attacks · Advanced [#session-hijacking](https://www.jkconcepts.at/en/website-security-glossary/#session-hijacking) ### What is session hijacking? Session Hijacking · Taking over a session Session hijacking takes over a valid session without needing to know the original password. ### Technology, example and context #### Technical explanation Session identifiers can be stolen through XSS, malware, insecure transmission or leaks; short lifetimes and re-authentication limit the consequences. #### Example A stolen session cookie gives access to an account that is already logged in. #### Related terms [Session](https://www.jkconcepts.at/en/website-security-glossary/#session) [Cookie](https://www.jkconcepts.at/en/website-security-glossary/#cookie) [Cross-Site Scripting](https://www.jkconcepts.at/en/website-security-glossary/#xss) [HttpOnly](https://www.jkconcepts.at/en/website-security-glossary/#httponly) Basics · Basic [#social-engineering](https://www.jkconcepts.at/en/website-security-glossary/#social-engineering) ### What is social engineering? Social Engineering · Manipulating people Social engineering uses trust, time pressure or authority to get people to take risky actions. ### Technology, example and context #### Technical explanation Technical controls help, but must be complemented by verifiable processes for access, payments and support requests. #### Example A supposed managing director requests an urgent bank transfer by email. #### Related terms [Phishing](https://www.jkconcepts.at/en/website-security-glossary/#phishing) [MFA / 2FA](https://www.jkconcepts.at/en/website-security-glossary/#mfa) [Authentication](https://www.jkconcepts.at/en/website-security-glossary/#authentication) Attacks · Advanced [#supply-chain-attack](https://www.jkconcepts.at/en/website-security-glossary/#supply-chain-attack) ### What is a software supply chain attack? Software Supply Chain Attack · Attack via the software supply chain A supply chain attack compromises software via vendors, build processes, updates or dependencies. ### Technology, example and context #### Technical explanation Protection includes verifiable sources, minimal dependencies, lockfiles, signatures, isolated builds, an inventory and a fast response to advisories. #### Example A manipulated package version is pulled into many applications through a regular update. #### Related terms [Dependency Confusion](https://www.jkconcepts.at/en/website-security-glossary/#dependency-confusion) [Subresource Integrity](https://www.jkconcepts.at/en/website-security-glossary/#subresource-integrity) [Plugin Vulnerability](https://www.jkconcepts.at/en/website-security-glossary/#plugin-vulnerability) [CVE](https://www.jkconcepts.at/en/website-security-glossary/#cve) Attacks · Advanced [#sql-injection](https://www.jkconcepts.at/en/website-security-glossary/#sql-injection) ### What is SQL injection? SQL Injection · Injecting SQL commands SQL injection arises when uncontrolled input can change the structure of a database query. ### Technology, example and context #### Technical explanation Parameterised queries separate data from SQL syntax; further measures are minimal database permissions, secure error handling and input validation. #### Example An application appends form input directly to an SQL string instead of using prepared parameters. #### Related terms [Database](https://www.jkconcepts.at/en/web-technology-glossary/#database) [Injection](https://www.jkconcepts.at/en/website-security-glossary/#injection) [Web Application Firewall](https://www.jkconcepts.at/en/website-security-glossary/#waf) [Least Privilege](https://www.jkconcepts.at/en/website-security-glossary/#least-privilege) Attacks · Technical [#ssrf](https://www.jkconcepts.at/en/website-security-glossary/#ssrf) ### What is SSRF? SSRF · Server-Side Request Forgery SSRF abuses a server function to call unauthorised targets from the server. ### Technology, example and context #### Technical explanation URL importers, webhooks and proxies are at risk; protection requires target allowlisting, network segmentation and robust checks after DNS resolution and redirects. #### Example An image importer is tricked into fetching an internal metadata endpoint instead of a public image. #### Related terms [Webhook](https://www.jkconcepts.at/en/website-security-glossary/#webhook) [API](https://www.jkconcepts.at/en/web-technology-glossary/#api) [Least Privilege](https://www.jkconcepts.at/en/website-security-glossary/#least-privilege) [Zero Trust](https://www.jkconcepts.at/en/website-security-glossary/#zero-trust) Safeguards · Technical [#subresource-integrity](https://www.jkconcepts.at/en/website-security-glossary/#subresource-integrity) ### What is subresource integrity? Subresource Integrity · SRI SRI lets browsers check whether an externally loaded resource matches the expected cryptographic hash exactly. ### Technology, example and context #### Technical explanation The integrity attribute contains one or more hash values; for cross-origin resources, the CORS configuration must allow the check. #### Example A CDN script is only executed if its content matches the stored SHA-384 hash. #### Related terms [Content Security Policy](https://www.jkconcepts.at/en/website-security-glossary/#csp) [Software Supply Chain Attack](https://www.jkconcepts.at/en/website-security-glossary/#supply-chain-attack) [CORS](https://www.jkconcepts.at/en/website-security-glossary/#cors) [Hashing](https://www.jkconcepts.at/en/website-security-glossary/#hashing) ## Terms starting with T Web basics · Advanced [#tls](https://www.jkconcepts.at/en/website-security-glossary/#tls) ### What is TLS? TLS · Transport Layer Security TLS is a protocol for encrypted network connections that are protected against tampering. ### Technology, example and context #### Technical explanation The handshake negotiates the version and cryptographic methods, checks certificates and derives session keys for symmetric encryption. #### Example HTTPS, secure mail transfer and many APIs use TLS to protect the transport. #### Related terms [HTTPS](https://www.jkconcepts.at/en/website-security-glossary/#https) [TLS Certificate](https://www.jkconcepts.at/en/website-security-glossary/#certificate) [Encryption](https://www.jkconcepts.at/en/website-security-glossary/#encryption) [HSTS](https://www.jkconcepts.at/en/website-security-glossary/#hsts) Web basics · Advanced [#certificate](https://www.jkconcepts.at/en/website-security-glossary/#certificate) ### What is an SSL certificate? TLS Certificate · Digital certificate for a host name A TLS certificate confirms that a public key belongs to a domain name. ### Technology, example and context #### Technical explanation Browsers check the signature, validity, host name and the certificate chain up to a trusted certificate authority. #### Example Let’s Encrypt provides automatable domain certificates for HTTPS. #### Related terms [TLS](https://www.jkconcepts.at/en/website-security-glossary/#tls) [HTTPS](https://www.jkconcepts.at/en/website-security-glossary/#https) [Encryption](https://www.jkconcepts.at/en/website-security-glossary/#encryption) Identity & access · Advanced [#totp](https://www.jkconcepts.at/en/website-security-glossary/#totp) ### What is TOTP? TOTP · Time-based One-Time Password TOTP generates short-lived one-time codes from a shared secret key and the current time. ### Technology, example and context #### Technical explanation Server and authenticator compute the same value in time windows; the method is stronger than a password alone, but not fully phishing-resistant. #### Example An authenticator app shows a new six-digit code every 30 seconds. #### Related terms [MFA / 2FA](https://www.jkconcepts.at/en/website-security-glossary/#mfa) [Authentication](https://www.jkconcepts.at/en/website-security-glossary/#authentication) [Passkey](https://www.jkconcepts.at/en/website-security-glossary/#passkey) [Phishing](https://www.jkconcepts.at/en/website-security-glossary/#phishing) ## Terms starting with V Basics · Basic [#vulnerability](https://www.jkconcepts.at/en/website-security-glossary/#vulnerability) ### What is a security vulnerability? Vulnerability · Security hole or weakness A vulnerability is a weakness that can impair the security properties of a system. ### Technology, example and context #### Technical explanation Vulnerabilities can arise from code errors, insecure design, misconfiguration, dependencies or poor operating processes. #### Example A missing permission check allows a user to access other people’s records. #### Related terms [Exploit](https://www.jkconcepts.at/en/website-security-glossary/#exploit) [CVE](https://www.jkconcepts.at/en/website-security-glossary/#cve) [CWE](https://www.jkconcepts.at/en/website-security-glossary/#cwe) [Security Patch](https://www.jkconcepts.at/en/website-security-glossary/#patch) ## Terms starting with W Safeguards · Advanced [#waf](https://www.jkconcepts.at/en/website-security-glossary/#waf) ### What is a web application firewall? Web Application Firewall · WAF A WAF analyses HTTP traffic and blocks suspicious requests before they reach a web application. ### Technology, example and context #### Technical explanation Rules can detect known attack patterns, bots, rates and application-specific anomalies; a WAF does not replace a secure application. #### Example A virtual patch rule blocks known exploit requests until a software update has been installed. #### Related terms [Firewall](https://www.jkconcepts.at/en/website-security-glossary/#firewall) [SQL Injection](https://www.jkconcepts.at/en/website-security-glossary/#sql-injection) [Cross-Site Scripting](https://www.jkconcepts.at/en/website-security-glossary/#xss) [Zero-Day](https://www.jkconcepts.at/en/website-security-glossary/#zero-day) **Securing your website technically?** [See website security →](https://www.jkconcepts.at/en/wordpress-security/) Web basics · Basic [#webserver](https://www.jkconcepts.at/en/website-security-glossary/#webserver) ### What is a web server? Web Server · Server for HTTP requests A web server accepts HTTP requests and delivers files or dynamically generated responses to browsers and other clients. ### Technology, example and context #### Technical explanation Software such as nginx or Apache handles TLS, routing, caching, compression and forwarding to application processes. #### Example The web server delivers a static HTML file directly or forwards a PHP request to PHP-FPM. #### Related terms [HTTP](https://www.jkconcepts.at/en/web-technology-glossary/#http) [Request & Response](https://www.jkconcepts.at/en/web-technology-glossary/#request-response) [Web Hosting](https://www.jkconcepts.at/en/web-technology-glossary/#webhosting) [Backend](https://www.jkconcepts.at/en/website-security-glossary/#backend) Identity & access · Technical [#webauthn](https://www.jkconcepts.at/en/website-security-glossary/#webauthn) ### What is WebAuthn? WebAuthn · Web Authentication API WebAuthn is the browser API for strong public-key logins with passkeys and security keys. ### Technology, example and context #### Technical explanation The server sends a challenge; the authenticator signs it for the specific relying party, preventing simple phishing reuse. #### Example A hardware security key confirms the administrator login. #### Related terms [Passkey](https://www.jkconcepts.at/en/website-security-glossary/#passkey) [Authentication](https://www.jkconcepts.at/en/website-security-glossary/#authentication) [MFA / 2FA](https://www.jkconcepts.at/en/website-security-glossary/#mfa) [Phishing](https://www.jkconcepts.at/en/website-security-glossary/#phishing) Web basics · Advanced [#webhook](https://www.jkconcepts.at/en/website-security-glossary/#webhook) ### What is a webhook? Webhook · Event-driven HTTP call A webhook automatically informs another system about an event via HTTP. ### Technology, example and context #### Technical explanation The sender calls a registered URL; receivers should check signatures, tolerate retries and make processing idempotent. #### Example A payment provider tells the shop that a payment has been completed successfully. #### Related terms [API](https://www.jkconcepts.at/en/web-technology-glossary/#api) [REST API](https://www.jkconcepts.at/en/web-technology-glossary/#rest-api) [Authentication](https://www.jkconcepts.at/en/website-security-glossary/#authentication) [Rate Limiting](https://www.jkconcepts.at/en/website-security-glossary/#rate-limiting) Basics · Basic [#website-security](https://www.jkconcepts.at/en/website-security-glossary/#website-security) ### What is website security? Website Security · Protecting websites and web applications Website security covers technical and organisational measures against unauthorised access, tampering, data loss and outages. ### Technology, example and context #### Technical explanation Effective protection combines secure development, minimal permissions, updates, hardening, backups, monitoring and a prepared response process. #### Example A WordPress website is kept up to date, protected with MFA, monitored and backed up regularly. #### Why does it matter? Security is not a single plugin, but an ongoing process across application, hosting, accounts and operation. #### Related terms [Vulnerability](https://www.jkconcepts.at/en/website-security-glossary/#vulnerability) [WordPress Hardening](https://www.jkconcepts.at/en/website-security-glossary/#wordpress-hardening) [Monitoring](https://www.jkconcepts.at/en/website-security-glossary/#monitoring) [Backup](https://www.jkconcepts.at/en/website-security-glossary/#backup) **Securing your website technically?** [See website security →](https://www.jkconcepts.at/en/wordpress-security/) Web basics · Basic [#wordpress](https://www.jkconcepts.at/en/website-security-glossary/#wordpress) ### What is WordPress? WordPress · Open-source content management system WordPress is a widely used open-source CMS for websites, editorial content and, with extensions, online shops. ### Technology, example and context #### Technical explanation WordPress is based mainly on PHP and MySQL, has theme, plugin, hook, role and REST API systems and needs ongoing updates. #### Example A custom theme reflects the corporate design, while structured content fields make maintenance easier. #### Why does it matter? Quality depends heavily on architecture, extensions, maintenance, hosting and security configuration. #### Related terms [CMS](https://www.jkconcepts.at/en/web-technology-glossary/#cms) [PHP](https://www.jkconcepts.at/en/web-technology-glossary/#php) [MySQL](https://www.jkconcepts.at/en/web-technology-glossary/#mysql) [WordPress Hardening](https://www.jkconcepts.at/en/website-security-glossary/#wordpress-hardening) **Building WordPress your way – and maintainable?** [See WordPress development →](https://www.jkconcepts.at/en/wordpress-development/) WordPress security · Advanced [#wordpress-hardening](https://www.jkconcepts.at/en/website-security-glossary/#wordpress-hardening) ### What is WordPress hardening? WordPress Hardening · Targeted hardening of a WordPress installation WordPress hardening reduces unnecessary attack surface and limits the consequences of a security problem. ### Technology, example and context #### Technical explanation This includes minimal extensions and permissions, secure accounts, updates, a protected configuration, restrictive file permissions, headers, backups and monitoring. #### Example Unused plugins are removed, administrators use MFA and critical files are not publicly writable. #### Related terms [WordPress](https://www.jkconcepts.at/en/website-security-glossary/#wordpress) [Plugin Vulnerability](https://www.jkconcepts.at/en/website-security-glossary/#plugin-vulnerability) [File Integrity Monitoring](https://www.jkconcepts.at/en/website-security-glossary/#file-integrity-monitoring) [Backup](https://www.jkconcepts.at/en/website-security-glossary/#backup) **Hardening WordPress before something happens?** [See WordPress security →](https://www.jkconcepts.at/en/wordpress-security/) WordPress security · Technical [#wordpress-nonce](https://www.jkconcepts.at/en/website-security-glossary/#wordpress-nonce) ### What is a WordPress nonce? WordPress Nonce · Time-limited proof of an action A WordPress nonce confirms that an action was triggered from an expected application context. ### Technology, example and context #### Technical explanation WordPress nonces are time-based tokens rather than single-use random values; they complement, but don’t replace, permission checks. #### Example An admin form checks the nonce and capability before making a change. #### Related terms [CSRF](https://www.jkconcepts.at/en/website-security-glossary/#csrf) [Authorisation](https://www.jkconcepts.at/en/website-security-glossary/#authorization) [WordPress](https://www.jkconcepts.at/en/website-security-glossary/#wordpress) [Authentication](https://www.jkconcepts.at/en/website-security-glossary/#authentication) WordPress security · Technical [#wordpress-security-keys](https://www.jkconcepts.at/en/website-security-glossary/#wordpress-security-keys) ### What are WordPress security keys? WordPress Security Keys · Authentication keys and salts WordPress security keys and salts strengthen cryptographic signatures for cookies and other security values. ### Technology, example and context #### Technical explanation The secret random values are stored in wp-config.php; changing them invalidates existing login cookies and requires secure file permissions. #### Example After a security incident, the keys are rotated so that old sessions lose their validity. #### Related terms [Hashing](https://www.jkconcepts.at/en/website-security-glossary/#hashing) [Cookie](https://www.jkconcepts.at/en/website-security-glossary/#cookie) [Session](https://www.jkconcepts.at/en/website-security-glossary/#session) [WordPress Hardening](https://www.jkconcepts.at/en/website-security-glossary/#wordpress-hardening) WordPress security · Technical [#wp-cron](https://www.jkconcepts.at/en/website-security-glossary/#wp-cron) ### What is WP-Cron? WP-Cron · Event scheduling in WordPress WP-Cron runs scheduled WordPress tasks, but by default is triggered by page views. ### Technology, example and context #### Technical explanation With irregular or high traffic, a real system cron can be more reliable; blocked or overloaded cron runs affect updates and background jobs. #### Example Scheduled publications and WooCommerce background tasks depend on cron events running reliably. #### Related terms [WordPress](https://www.jkconcepts.at/en/website-security-glossary/#wordpress) [Monitoring](https://www.jkconcepts.at/en/website-security-glossary/#monitoring) [Backend](https://www.jkconcepts.at/en/website-security-glossary/#backend) ## Terms starting with X WordPress security · Technical [#xml-rpc](https://www.jkconcepts.at/en/website-security-glossary/#xml-rpc) ### What is XML-RPC in WordPress? XML-RPC · WordPress interface via XML and HTTP XML-RPC is an older WordPress interface for remote calls that some apps and integrations use. ### Technology, example and context #### Technical explanation Methods that aren’t needed can be disabled or limited at the edge; switching it off across the board can affect dependent features. #### Example Automated login attempts abuse reachable XML-RPC methods. #### Related terms [WordPress](https://www.jkconcepts.at/en/website-security-glossary/#wordpress) [Brute Force](https://www.jkconcepts.at/en/website-security-glossary/#brute-force) [API](https://www.jkconcepts.at/en/web-technology-glossary/#api) [Rate Limiting](https://www.jkconcepts.at/en/website-security-glossary/#rate-limiting) ## Terms starting with Z Identity & access · Advanced [#zero-trust](https://www.jkconcepts.at/en/website-security-glossary/#zero-trust) ### What does zero trust mean? Zero Trust · Continuously verified access Zero trust does not automatically treat location or network membership as proof of trust. ### Technology, example and context #### Technical explanation Access is assessed on the basis of identity, device state, context, minimal permissions and ongoing signals. #### Example An internal admin service requires a strong login and explicit permission even from within the company network. #### Related terms [Authentication](https://www.jkconcepts.at/en/website-security-glossary/#authentication) [Authorisation](https://www.jkconcepts.at/en/website-security-glossary/#authorization) [Least Privilege](https://www.jkconcepts.at/en/website-security-glossary/#least-privilege) [MFA / 2FA](https://www.jkconcepts.at/en/website-security-glossary/#mfa) Basics · Advanced [#zero-day](https://www.jkconcepts.at/en/website-security-glossary/#zero-day) ### What is a zero-day? Zero-Day · A vulnerability not yet fixed A zero-day is a vulnerability for which no generally available fix exists at the relevant point in time. ### Technology, example and context #### Technical explanation Compensating controls such as WAF rules, disabling features, isolation or restricting access can reduce the risk until a patch is available. #### Example An actively attacked plugin has to be deactivated temporarily because no update is available yet. #### Related terms [Vulnerability](https://www.jkconcepts.at/en/website-security-glossary/#vulnerability) [Exploit](https://www.jkconcepts.at/en/website-security-glossary/#exploit) [Security Patch](https://www.jkconcepts.at/en/website-security-glossary/#patch) [Web Application Firewall](https://www.jkconcepts.at/en/website-security-glossary/#waf) Check the risk properly ## Not sure how well your website is protected? A technical review shows outdated components, misconfigurations, missing layers of protection and sensible next steps.