Website security glossary
What are XSS, SQL injection or a WAF? How do MFA, security headers and backups protect a website? This glossary explains risks and countermeasures clearly and with technical precision.
Understand attacks, put protection in context
The terms focus on websites, web applications, WordPress and secure operations – with cross-references between attacks, causes and safeguards.
AI Guardrails · Technical and organisational guardrails
Rules, checks and limits around the inputs, outputs and actions of an AI system.
An application blocks sensitive data, validates outputs and requires approval before external actions.
Guardrails reduce certain risks, but must be implemented in several layers and tested regularly against real failure cases.
Authentication · Verifying an identity
Authentication checks who a user or system is.
After a successful check, a system usually issues a session or token; secure methods also cover recovery and logout.
A user proves their identity with a passkey or with a password plus TOTP.
Authorisation · Permission check
Authorisation decides which data and actions an identified person or system may use.
Checks must happen on the server for every protected object and every action; roles alone are often not enough for object-specific rules.
An editor may edit content but not manage user accounts.
Backdoor · Hidden persistent access
A backdoor enables hidden access that bypasses regular security controls.
Backdoors can persist as obfuscated files, manipulated plugins, database content, user accounts or scheduled tasks.
A seemingly harmless PHP file executes commands from an encrypted request parameter.
Backend · The server-side part of an application
The backend handles business logic, data access, permissions and interfaces outside the visible browser interface.
Backend processes validate requests, coordinate services and databases and generate HTML or structured API responses.
A contact backend checks inputs, limits abuse and stores an enquiry.
Backup · Restorable data copy
A backup is a separate copy of data and configuration from which a system can be restored.
Reliable backups have suitable intervals, retention, access protection, off-site copies and regularly tested restore processes.
A website’s files and database are backed up daily, with versions, to separate storage.
Bot Attack · Automated attack
A bot attack automates abusive actions such as login attempts, scraping, spam or shopping basket manipulation.
Detection combines behavioural signals, rate limits, reputation and application-specific rules; IP blocks alone are often not enough.
Automated programs test stolen account data against a shop login.
Bot Protection · Protection against automated abuse
Bot protection detects and limits automated access without locking out welcome crawlers and real users across the board.
Signals include rates, behaviour, browser characteristics, reputation, account context and application-specific flows.
A shop limits automated checkout attempts while still letting search engines crawl.
Brute Force · Systematic trial and error
A brute-force attack tries many possible credentials or keys automatically.
Rate limits, progressive delays, MFA, strong passwords, anomaly detection and safe lockout mechanisms form combined layers of protection.
A bot sends thousands of password attempts against wp-login.php.
CDN · Content Delivery Network
A CDN distributes and stores content across several locations so that it can be delivered closer to visitors.
Edge servers answer cacheable requests, often terminate TLS and can add protective functions such as DDoS defence or a WAF.
Images and scripts of an Austrian website are loaded from regional edge locations for international visitors.
Content Security Policy · CSP
A CSP limits the sources from which a page may load scripts, styles, images and other resources.
The HTTP policy works with directives and source expressions; nonces or hashes can mark specifically permitted inline code.
script-src 'self' basically only allows scripts from the page’s own origin.
A carefully introduced CSP makes XSS harder, but can block legitimate features if misconfigured.
Cookie · HTTP value stored by the browser
A cookie is a small value that a website can set in the browser and have sent along with matching later requests.
Attributes such as Domain, Path, Expires, Secure, HttpOnly and SameSite limit lifetime and transmission.
A random session identifier connects several requests to a logged-in session.
Cookies can be technically necessary or require consent and transparent privacy information.
CORS · Cross-Origin Resource Sharing
CORS controls which other origins browsers may allow to access a server’s resources.
Servers set Access-Control-Allow-* headers; non-simple requests can trigger an OPTIONS preflight. CORS is not server-side authentication.
An API only allows browser access from the frontend’s production domain.
Credential Stuffing · Reuse of stolen credentials
Credential stuffing automatically tests known combinations of email address and password on other services.
The attack exploits password reuse rather than a vulnerability in the target; MFA, passkeys, rate limits and leaked-credential checks help.
Data from someone else’s data leak is tested against a shop’s customer login.
Cross-Site Scripting · XSS
XSS allows untrusted content to be executed as active code in other users’ browsers.
Context-specific output encoding, safe DOM APIs, sanitising and a restrictive CSP form the central layers of protection.
An unfiltered comment is output as HTML and contains an executable script element.
CSRF · Cross-Site Request Forgery
CSRF makes a logged-in browser send a state-changing request without the user intending to.
Synchroniser tokens, SameSite cookies, origin checks and safe HTTP methods reduce the risk; XSS can bypass many CSRF protections.
A third-party page triggers an account change in the background on a service where you are already logged in.
CVE · Common Vulnerabilities and Exposures
A CVE ID uniquely identifies a specific, publicly recorded security vulnerability.
The identifier makes it referenceable, while the description, affected versions, rating and countermeasures come from advisories and databases.
A vendor advisory names a CVE and the first patched plugin version.
CVSS · Common Vulnerability Scoring System
CVSS describes the technical characteristics and severity of a vulnerability as a standardised vector and numerical value.
The base score alone does not determine the operational risk; exposure, affected data, active exploitation and existing controls belong in the prioritisation.
A highly rated vulnerability in a deactivated component may be prioritised differently from an actively exploited medium one.
CWE · Common Weakness Enumeration
CWE classifies general types of software and hardware weaknesses.
A CVE typically describes a specific vulnerability in a product, a CWE the underlying error pattern.
SQL injection is a type of weakness; specific affected plugin versions may receive CVE IDs.
Cybersecurity · Information and IT security
Cybersecurity protects digital systems, data and services against attacks, misuse and unintentional damage.
The field covers prevention, detection, response and recovery across identities, applications, networks, devices and processes.
Access controls, secure configuration, logging and emergency plans reduce the risk together.
Data Protection · Protection of personal data
Rules and measures for the lawful, purpose-bound and secure processing of personal data.
Before using an AI service, the purpose, necessary data, provider, storage location, contracts and deletion periods are checked.
AI doesn’t change the principles of data protection. What matters is the specific data flow, not the label of the tool used.
DDoS · Distributed Denial of Service
A DDoS attack tries to overload a service with distributed requests or data streams.
Protection is implemented at network, protocol and application level and often needs upstream anycast, CDN or scrubbing infrastructure.
Many compromised devices send requests to an online shop at the same time.
Dependency Confusion · Mixing up internal and public packages
Dependency confusion tricks a build system into loading a malicious public package instead of an intended internal dependency.
Unique namespaces, fixed registries, lockfiles and controlled resolution prevent surprising changes of source.
A publicly released package has the same name as an internal library and a higher version number.
Disaster Recovery · Planned recovery after an outage
Disaster recovery describes prepared processes for restoring systems and data after serious disruptions.
Targets such as RTO and RPO, responsibilities, alternative infrastructure, key material and tested runbooks determine how restorable a system really is.
After a server failure, the website is started on new infrastructure from a verified backup.
Encryption · Making data unreadable without a key
Encryption uses a key to turn data into a form that cannot be read directly and is reversible in principle.
Symmetric methods use the same secret key, asymmetric ones a matching pair of public and private keys.
TLS encrypts data in transit between browser and server.
Exploit · Taking advantage of a vulnerability
An exploit is a method or piece of code that deliberately takes advantage of a vulnerability.
The impact ranges from information disclosure through privilege escalation to arbitrary code execution; prerequisites can be a version, configuration or user interaction.
A specially crafted request triggers an error and bypasses an access control.
File Inclusion · Unsafe inclusion of files
File inclusion arises when untrusted input determines which file an application loads or executes.
LFI targets local sources, RFI remote ones; fixed mappings instead of dynamic paths and minimal runtime permissions reduce the risk.
A template parameter is passed unchecked to a server-side include function.
File Integrity Monitoring · Monitoring file changes
File integrity monitoring detects unexpected changes to monitored files.
Comparisons use hashes, known vendor versions or controlled baselines; legitimate deployments must be distinguishable from suspicious changes.
An alert reports a new PHP file in an upload directory.
Firewall · Control point for network traffic
A firewall allows or blocks network traffic based on defined rules.
Depending on the layer, addresses, ports, connection states, protocols or application characteristics are evaluated.
A database port can only be reached from the internal application network.
Hashing · One-way mapping of data
Hashing produces a fixed-length value from data, with no intended way of reversing it.
Passwords need slow, memory-intensive methods with an individual salt; fast checksums such as SHA-256 alone are unsuitable for this.
A login compares an Argon2id hash instead of a stored plain-text password.
HSTS · HTTP Strict Transport Security
HSTS instructs browsers to access a domain only via HTTPS for a defined period.
The Strict-Transport-Security header can include subdomains; preloading also reduces the risk on the very first visit.
A browser locally replaces a later http request with https.
HTTP 500 · Internal Server Error
The status code 500 reports an unexpected server-side error while processing a request.
The public response is deliberately generic; specific causes are found in application and server logs and can range from code errors to resource problems.
A faulty plugin triggers an unhandled PHP exception.
HTTP Header · Metadata of an HTTP message
HTTP headers carry additional information about a request or response.
Headers control, among other things, content type, caching, authentication, compression, cookies, CORS and browser security rules.
Content-Type: application/json marks a JSON response.
HttpOnly · Cookie protection against JavaScript access
HttpOnly prevents JavaScript in the browser from reading a cookie’s value directly.
The browser still sends the cookie automatically with matching HTTP requests; CSRF protection and XSS prevention therefore remain necessary.
The session ID is not visible to document.cookie.
HTTPS · HTTP over TLS
HTTPS uses TLS to protect the connection between client and server against simple eavesdropping and tampering.
After the TLS handshake, HTTP messages are transmitted encrypted and authenticated; the certificate binds the public key to a host name.
A login form does not transmit credentials as unencrypted plain text over the network.
HTTPS is a basic requirement for secure forms, modern browser features and trustworthy website operation.
Injection · Injecting commands or syntax
In an injection, data is processed in such a way that it unintentionally acts as commands or program syntax.
Secure APIs, context-aware encoding, parameterisation, strict separation of data and code and minimal permissions reduce the risk.
SQL, operating system or template syntax reaches an interpreter through unsecured input.
Input Validation · Checking input data
Input validation checks whether data matches the expected types, formats, lengths and business rules.
The decisive check happens at the trust boundary on the server; it does not replace context-specific encoding or parameterised APIs.
An ID must be a positive integer and refer to a record the user is authorised to access.
IP Blocking · Blocking network addresses
IP blocking refuses requests from selected IP addresses or networks.
The measure is coarse because addresses can be shared, dynamic or changed via proxies; it should be part of multi-layered detection.
A clearly abusive host is temporarily blocked at the web server.
Least Privilege · Principle of minimal permissions
Least privilege grants only the permissions that are actually needed for a specific task.
The principle applies to users, processes, databases, API tokens and networks and limits the impact of compromised components.
The website connects to a database account without global administrator rights.
Logging · Recording events
Logging records technical and security-relevant events for diagnosis, traceability and detection.
Good logs contain the time, event type and necessary context, avoid sensitive content and are protected against unnoticed tampering.
Failed logins are logged with the account, time and approximate origin.
Malware · Malicious software
Malware is software or injected code with a malicious or unauthorised function.
On websites, malware modifies files or databases, creates access, redirects visitors, sends spam or loads further components.
A compromised plugin injects a script that redirects visitors to fraudulent sites.
A clean-up has to deal not only with visible files, but also with the entry point, persistence and compromised credentials.
Malware Scanning · Automated search for malicious code
Malware scanning examines files, content or behaviour for signs of malicious code.
Signatures, heuristics, reputation data and file comparisons complement each other; no single scan proves that a system is clean.
A scanner finds a known web shell signature in a modified plugin file.
MFA / 2FA · Multi-factor authentication
MFA requires several independent proofs for a login.
Factors typically come from knowledge, possession or inherence; phishing-resistant methods such as WebAuthn are stronger than transferable one-time codes.
In addition to the password, an administrator confirms the login with a security key.
Monitoring · Ongoing system monitoring
Monitoring observes the availability, performance, errors and selected security signals of a system.
Metrics, synthetic checks and log signals need thresholds, alerting paths and responsible responses so that data turns into action.
An alert is triggered when the website cannot be reached or errors rise sharply.
Passkey · Phishing-resistant login with a key pair
A passkey logs a user in with a cryptographic key pair instead of a shared password.
The private key stays on the device or in a protected sync system; the server only stores the public key and a credential ID.
A login is confirmed with the device PIN or biometrics without sending a password to the website.
Path Traversal · Unauthorised file path access
Path traversal manipulates file paths in order to access files outside a permitted directory.
Applications should not use user input directly as paths, should check canonical targets and limit file access to defined roots.
A download function accepts ../ sequences and delivers a configuration file.
Phishing · Deception to obtain sensitive information
Phishing fakes trustworthy communication in order to obtain credentials, payments or other sensitive actions.
Attackers combine social engineering with cloned login pages, prepared attachments, OAuth grants or fraudulent payment instructions.
A fake hosting message asks you to log in on a domain with a similar spelling.
Plugin Vulnerability · Weakness in an extension
A plugin vulnerability is an exploitable weakness in an extension or its configuration.
The risk depends on reachability, required permissions, active use, available exploits and possible impact.
An upload function does not check the file type and permissions sufficiently.
Privilege Escalation · Gaining more permissions
Privilege escalation gives a user or process more permissions than intended.
Vertical escalation reaches higher roles, horizontal escalation accesses other people’s resources at the same level; server-side authorisation is decisive.
A normal user changes a URL and reaches an action intended only for administrators.
Prompt Injection · Manipulation through injected instructions
An attack in which malicious instructions in inputs or in content that is read are meant to manipulate the AI system.
A document contains hidden instructions intended to make an agent reveal data or call a tool.
As soon as models read external content or use tools, system prompts are not enough; permissions and actions must be limited technically.
Ransomware · Extortion software
Ransomware encrypts or withholds data and systems in order to extort a payment.
Attacks often combine credential theft, lateral movement, data exfiltration and targeted sabotage of backups.
A compromised administrator account is used to encrypt server data and any backups that can be reached.
Rate Limiting · Limiting requests
Rate limiting restricts how many actions are allowed within a period of time.
Limits can apply per account, token, IP, route or risk signal; distributed systems need a shared or consistent counter.
After several failed logins, further attempts are delayed step by step.
Remote Code Execution · RCE
Remote code execution makes it possible to run an attacker’s code on a remote system.
RCE can arise from injection, insecure deserialisation, file uploads, memory corruption or compromised dependencies and usually has a high impact.
A vulnerable extension executes an injected system command with the web server’s permissions.
robots.txt · Crawler control file
robots.txt gives cooperating crawlers rules for fetching certain areas of a website.
The file lives at the origin under /robots.txt; Disallow does not prevent access and is no reliable protection against indexing or attackers.
Internal search results are excluded from crawling by search engine bots.
SameSite Cookie · Limiting cross-site cookie transmission
SameSite controls when a browser sends cookies with requests from a different site context.
Strict, Lax and None have different rules for navigation and embedding; SameSite=None requires Secure.
A Lax session cookie reduces many simple CSRF scenarios without preventing normal link navigation.
Secure Cookie · Cookie sent only over HTTPS
The Secure attribute ensures that a cookie is only sent over encrypted HTTPS connections.
It doesn’t protect against client-side reading and should be combined for sensitive cookies with HttpOnly, SameSite and narrow domain and path limits.
A session cookie is never transmitted over an unencrypted HTTP connection.
Security Headers · HTTP security headers
Security headers give the browser additional security rules for a website.
CSP, HSTS, frame-ancestors, Referrer-Policy and other headers limit loading sources, protocol downgrades, embedding and the sharing of information.
A CSP prevents arbitrary third-party scripts from being executed on a page.
Security Patch · Security update
A security patch is a change that fixes known security problems or makes exploiting them harder.
Before installing, dependencies, compatibility, backups and a way back should be checked; delayed patches widen the window of attack.
A plugin update closes a published access control vulnerability.
Session · Server-side session state
A session keeps related user requests in a shared state across several page views.
Usually the server stores the state and the browser only sends a random session ID in a protected cookie.
After login, the server recognises the logged-in user from the session ID.
Session Hijacking · Taking over a session
Session hijacking takes over a valid session without needing to know the original password.
Session identifiers can be stolen through XSS, malware, insecure transmission or leaks; short lifetimes and re-authentication limit the consequences.
A stolen session cookie gives access to an account that is already logged in.
Social Engineering · Manipulating people
Social engineering uses trust, time pressure or authority to get people to take risky actions.
Technical controls help, but must be complemented by verifiable processes for access, payments and support requests.
A supposed managing director requests an urgent bank transfer by email.
Software Supply Chain Attack · Attack via the software supply chain
A supply chain attack compromises software via vendors, build processes, updates or dependencies.
Protection includes verifiable sources, minimal dependencies, lockfiles, signatures, isolated builds, an inventory and a fast response to advisories.
A manipulated package version is pulled into many applications through a regular update.
SQL Injection · Injecting SQL commands
SQL injection arises when uncontrolled input can change the structure of a database query.
Parameterised queries separate data from SQL syntax; further measures are minimal database permissions, secure error handling and input validation.
An application appends form input directly to an SQL string instead of using prepared parameters.
SSRF · Server-Side Request Forgery
SSRF abuses a server function to call unauthorised targets from the server.
URL importers, webhooks and proxies are at risk; protection requires target allowlisting, network segmentation and robust checks after DNS resolution and redirects.
An image importer is tricked into fetching an internal metadata endpoint instead of a public image.
Subresource Integrity · SRI
SRI lets browsers check whether an externally loaded resource matches the expected cryptographic hash exactly.
The integrity attribute contains one or more hash values; for cross-origin resources, the CORS configuration must allow the check.
A CDN script is only executed if its content matches the stored SHA-384 hash.
TLS · Transport Layer Security
TLS is a protocol for encrypted network connections that are protected against tampering.
The handshake negotiates the version and cryptographic methods, checks certificates and derives session keys for symmetric encryption.
HTTPS, secure mail transfer and many APIs use TLS to protect the transport.
TLS Certificate · Digital certificate for a host name
A TLS certificate confirms that a public key belongs to a domain name.
Browsers check the signature, validity, host name and the certificate chain up to a trusted certificate authority.
Let’s Encrypt provides automatable domain certificates for HTTPS.
TOTP · Time-based One-Time Password
TOTP generates short-lived one-time codes from a shared secret key and the current time.
Server and authenticator compute the same value in time windows; the method is stronger than a password alone, but not fully phishing-resistant.
An authenticator app shows a new six-digit code every 30 seconds.
Vulnerability · Security hole or weakness
A vulnerability is a weakness that can impair the security properties of a system.
Vulnerabilities can arise from code errors, insecure design, misconfiguration, dependencies or poor operating processes.
A missing permission check allows a user to access other people’s records.
Web Application Firewall · WAF
A WAF analyses HTTP traffic and blocks suspicious requests before they reach a web application.
Rules can detect known attack patterns, bots, rates and application-specific anomalies; a WAF does not replace a secure application.
A virtual patch rule blocks known exploit requests until a software update has been installed.
Web Server · Server for HTTP requests
A web server accepts HTTP requests and delivers files or dynamically generated responses to browsers and other clients.
Software such as nginx or Apache handles TLS, routing, caching, compression and forwarding to application processes.
The web server delivers a static HTML file directly or forwards a PHP request to PHP-FPM.
WebAuthn · Web Authentication API
WebAuthn is the browser API for strong public-key logins with passkeys and security keys.
The server sends a challenge; the authenticator signs it for the specific relying party, preventing simple phishing reuse.
A hardware security key confirms the administrator login.
Webhook · Event-driven HTTP call
A webhook automatically informs another system about an event via HTTP.
The sender calls a registered URL; receivers should check signatures, tolerate retries and make processing idempotent.
A payment provider tells the shop that a payment has been completed successfully.
Website Security · Protecting websites and web applications
Website security covers technical and organisational measures against unauthorised access, tampering, data loss and outages.
Effective protection combines secure development, minimal permissions, updates, hardening, backups, monitoring and a prepared response process.
A WordPress website is kept up to date, protected with MFA, monitored and backed up regularly.
Security is not a single plugin, but an ongoing process across application, hosting, accounts and operation.
WordPress · Open-source content management system
WordPress is a widely used open-source CMS for websites, editorial content and, with extensions, online shops.
WordPress is based mainly on PHP and MySQL, has theme, plugin, hook, role and REST API systems and needs ongoing updates.
A custom theme reflects the corporate design, while structured content fields make maintenance easier.
Quality depends heavily on architecture, extensions, maintenance, hosting and security configuration.
WordPress Hardening · Targeted hardening of a WordPress installation
WordPress hardening reduces unnecessary attack surface and limits the consequences of a security problem.
This includes minimal extensions and permissions, secure accounts, updates, a protected configuration, restrictive file permissions, headers, backups and monitoring.
Unused plugins are removed, administrators use MFA and critical files are not publicly writable.
WordPress Nonce · Time-limited proof of an action
A WordPress nonce confirms that an action was triggered from an expected application context.
WordPress nonces are time-based tokens rather than single-use random values; they complement, but don’t replace, permission checks.
An admin form checks the nonce and capability before making a change.
WordPress Security Keys · Authentication keys and salts
WordPress security keys and salts strengthen cryptographic signatures for cookies and other security values.
The secret random values are stored in wp-config.php; changing them invalidates existing login cookies and requires secure file permissions.
After a security incident, the keys are rotated so that old sessions lose their validity.
WP-Cron · Event scheduling in WordPress
WP-Cron runs scheduled WordPress tasks, but by default is triggered by page views.
With irregular or high traffic, a real system cron can be more reliable; blocked or overloaded cron runs affect updates and background jobs.
Scheduled publications and WooCommerce background tasks depend on cron events running reliably.
XML-RPC · WordPress interface via XML and HTTP
XML-RPC is an older WordPress interface for remote calls that some apps and integrations use.
Methods that aren’t needed can be disabled or limited at the edge; switching it off across the board can affect dependent features.
Automated login attempts abuse reachable XML-RPC methods.
Zero Trust · Continuously verified access
Zero trust does not automatically treat location or network membership as proof of trust.
Access is assessed on the basis of identity, device state, context, minimal permissions and ongoing signals.
An internal admin service requires a strong login and explicit permission even from within the company network.
Zero-Day · A vulnerability not yet fixed
A zero-day is a vulnerability for which no generally available fix exists at the relevant point in time.
Compensating controls such as WAF rules, disabling features, isolation or restricting access can reduce the risk until a patch is available.
An actively attacked plugin has to be deactivated temporarily because no update is available yet.
Try a more general search term or reset the filters.
Check the risk properly
A technical review shows outdated components, misconfigurations, missing layers of protection and sensible next steps.
Check website security