Website security glossary in plain English.
SQL injection, XSS, a WAF, PCI DSS — the terms that show up again and again in security reports, defined without the jargon. Bookmark this if a scan or an audit ever hands you a term you don't recognize.
Terms, A to Z
Authorization to Test
A signed agreement confirming a security tester has explicit permission to test a specific system. It protects both the tester and the site owner, and is what separates legitimate testing from unauthorized access.
Backdoor
Hidden code an attacker leaves behind after breaching a site, giving them a way back in even after the original vulnerability is patched — why a proper cleanup checks for backdoors, not just the entry point.
Brute-force attack
Repeatedly guessing passwords or codes — often automated, trying thousands per minute — until one works. WordPress login pages and admin panels are common targets.
Clickjacking
Tricking a user into clicking something different from what they perceive, usually by layering an invisible frame of a real page over a decoy. Preventable with response headers like X-Frame-Options or a Content-Security-Policy.
Cross-site request forgery (CSRF)
An attack that tricks a logged-in user’s browser into submitting an unwanted action — like changing an email address — on a site they’re already authenticated to, without their knowledge.
Cross-site scripting (XSS)
An attack where malicious script gets injected into a page other users view (often through a comment or input field), letting an attacker steal session cookies, deface content, or act as the victim in their own browser.
CVE (Common Vulnerabilities and Exposures)
A public, standardized ID — like CVE-2026-XXXXX — assigned to one specific, known security vulnerability, used across the industry to reference and track it consistently.
DDoS (Distributed Denial of Service)
Flooding a website or server with traffic from many sources at once, overwhelming it and taking it offline for legitimate visitors.
False positive
A vulnerability an automated scanner reports that turns out not to be real, or not actually exploitable once a human checks it in context — one of the main reasons automated-only reports need a human to verify severity before anyone spends time "fixing" a non-issue.
GDPR (General Data Protection Regulation)
An EU regulation governing how personal data of people in the EU is collected, stored, and processed. It applies to many websites with EU visitors regardless of where the business itself is based.
Malware
Software written to damage, disrupt, or gain unauthorized access to a system — includes viruses, spam injectors, and backdoors. On a hacked website, it’s often introduced via an outdated plugin or stolen credentials.
PCI DSS (Payment Card Industry Data Security Standard)
Security requirements any business that stores, processes, or transmits card payment data must follow, regardless of platform. A platform’s own PCI certification covers its infrastructure — not a merchant’s installed apps or admin access.
Penetration testing (pentest)
A simulated, authorized attack against a website or system to find exploitable weaknesses before a real attacker does. Manual pentesting uses a human tester; automated scanning uses software alone.
Phishing
A social-engineering attack that impersonates a trusted sender — a bank, a colleague, a familiar brand — to trick someone into revealing credentials or installing malware, usually via email or a fake login page.
Security headers
HTTP response headers — like Content-Security-Policy, Strict-Transport-Security, and X-Frame-Options — that tell a browser how to handle a site’s content more safely, closing off several common attack classes without changing application code.
SOC 2
An audit report — not a certification — demonstrating that a company’s internal controls meet a defined trust-services standard. Increasingly requested by enterprise customers before they’ll sign a contract.
SQL injection (SQLi)
An attack where untrusted input is inserted into a database query, letting an attacker read, modify, or delete data they shouldn’t have access to — often through a form field or URL parameter that isn’t properly sanitized.
SSL/TLS
The protocol that encrypts data in transit between a browser and a server — the padlock icon. It protects data from being intercepted, but says nothing about whether the application itself is secure.
Two-factor authentication (2FA)
Requiring a second proof of identity beyond a password — like a code from an app — before login succeeds, so a stolen or guessed password alone isn’t enough to break in.
Vulnerability scanning
An automated process that checks software against a database of known weaknesses and misconfigurations. Fast and cheap, but it can’t test business logic or chain small issues into a real exploit the way a human tester can.
Web Application Firewall (WAF)
A layer that filters and monitors HTTP traffic to a website, blocking common attack patterns — like SQL injection attempts — before they reach the application. A mitigation, not a substitute for fixing the underlying vulnerability.
Zero-day vulnerability
A security flaw that’s publicly known — or actively exploited — before the vendor has released a fix, meaning defenders have "zero days" of advance warning to patch it.
Go deeper
See what attackers see — free
Run the free passive check on your domain. No login, no impact on your site, results in seconds.