Web security glossary

Quick reference for the terms used for website security and OSINT.

Certificates

Certificate Authority (CA): An organisation such as Let's Encrypt that browsers trust to issue certificates. It checks who controls a domain before issuing one.Related check: SSL Certificate
Certificate Trust: Whether the certificate is valid for this hostname and was issued by an authority browsers trust.Related check: SSL Certificate
Certificate Expiry: Certificates are only valid until their expiry date, after which browsers refuse them.Related check: SSL Certificate
Subject Alternative Names (SANs): The hostnames a certificate covers. Browsers show a warning if the site's name isn't one of them.Related check: SSL Certificate
Certificate Fingerprint: A hash of the whole certificate. If two fingerprints match, it's the same certificate.Related check: SSL Certificate
Certificate Transparency: Public logs of every certificate issued, so one issued by mistake or by an attacker gets noticed.Related check: TLS Security Audit
CAA Records: DNS records naming which certificate authorities may issue certificates for the domain.Related check: CAA Records

TLS

HTTPS: The secure version of HTTP. It sends pages over an encrypted connection, so others on the network can't read or change them.Related check: TLS Connection
TLS and SSL: The encryption behind HTTPS. SSL was the version before it, retired years ago, but the name lives on in "SSL certificate".Related check: TLS Connection
TLS Handshake: The first few messages of a secure connection, where the browser and server agree on settings, swap keys and check the certificate.Related check: TLS Connection
Cipher Suite: The mix of algorithms used to encrypt and protect a connection, agreed during the handshake. Older suites have known weaknesses.Related check: TLS Connection
TLS Version: The version of TLS the connection used. Newer versions are faster and drop weaker encryption.Related check: TLS Connection
TLS 1.3: The newest version of TLS, with a faster handshake and only strong encryption.Related check: TLS Connection
TLS 1.0 and 1.1: Old versions of TLS with known weaknesses, which every major browser dropped in 2020.Related check: TLS Connection
SSL Labs Grade: Qualys SSL Labs' overall rating of a server's HTTPS setup, from A+ down to F.Related check: TLS Security Audit
Forward Secrecy: Each connection gets its own temporary key, so a stolen server key can't decrypt past traffic.Related check: TLS Connection
Session Resumption: Returning visitors can reuse an earlier secure session, skipping part of the handshake.Related check: TLS Connection
OCSP Stapling: The server attaches proof that its certificate hasn't been revoked, so browsers don't have to ask the issuer.Related check: TLS Connection
HTTP/2: A faster version of HTTP that loads many files at once over a single connection.Related check: TLS Connection
ALPN: Lets the browser and server pick a protocol, such as HTTP/2, inside the TLS handshake, which saves a round trip.Related check: TLS Connection
Renegotiation: Lets the browser and server agree new settings partway through a connection. Only the secure kind is safe.Related check: TLS Security Audit
Fallback SCSV: Stops attackers forcing a connection down to an older, weaker version of TLS.Related check: TLS Security Audit
ChaCha20: A cipher that runs faster than AES on phones and other devices without AES hardware.Related check: TLS Security Audit
AEAD Ciphers: Modern ciphers like AES-GCM and ChaCha20, which encrypt and check data in one step to avoid a whole class of attacks.Related check: TLS Security Audit
CBC Ciphers: An older cipher mode behind attacks like POODLE and Lucky 13.Related check: TLS Security Audit
TLS Compression: Compressing data before encrypting it, which the CRIME attack uses to steal cookies.Related check: TLS Security Audit
Key Exchange Reuse: Reusing the same temporary key exchange values across connections, which weakens forward secrecy.Related check: TLS Security Audit
Weak DH Primes: Widely shared Diffie-Hellman groups that are too small, so a well-funded attacker may already have broken them.Related check: TLS Security Audit
Client Compatibility: Whether a browser or device can complete a secure connection to the site.Related check: TLS Client Compatibility

TLS vulnerabilities

Downgrade Attack: Tricking a connection into using an older, weaker protocol or cipher, so it's easier to break.Related check: TLS Security Audit
Padding Oracle: A flaw where a server responds differently to badly padded data. By sending thousands of altered messages, attackers can use those replies to decrypt traffic.Related check: TLS Security Audit
Heartbleed: A bug in old OpenSSL versions that let anyone read server memory, including private keys and passwords.Related check: TLS Security Audit
POODLE: An attack on SSL 3.0 that decrypts data a byte at a time. Disabling SSL 3.0 fixes it.Related check: TLS Security Audit
POODLE (TLS): A version of POODLE that works against TLS servers which don't check padding properly.Related check: TLS Security Audit
Zombie POODLE: A padding oracle in some servers that brings POODLE-style attacks back to CBC ciphers.Related check: TLS Security Audit
GOLDENDOODLE: A faster padding oracle attack on CBC ciphers, found in some firewalls and load balancers.Related check: TLS Security Audit
Sleeping POODLE: Another padding oracle on CBC ciphers, found in some network devices.Related check: TLS Security Audit
Zero-Length Padding Oracle: An OpenSSL bug (CVE-2019-1559) that lets an attacker decrypt traffic on CBC ciphers.Related check: TLS Security Audit
FREAK: Tricks a connection into using deliberately weak 1990s export encryption, which can be cracked in hours.Related check: TLS Security Audit
Logjam: Downgrades the key exchange to weak Diffie-Hellman groups that can be broken.Related check: TLS Security Audit
DROWN: Uses any server that still supports SSL 2.0 with the same key to decrypt modern TLS traffic.Related check: TLS Security Audit
CCS Injection: An OpenSSL bug (CVE-2014-0224) that lets an attacker force weak keys and read traffic.Related check: TLS Security Audit
OpenSSL Padding Oracle: An OpenSSL bug (CVE-2016-2107) that lets an attacker decrypt AES-CBC traffic.Related check: TLS Security Audit
ROBOT: A revived attack on RSA key exchange that can decrypt traffic, or sign messages with the server's key.Related check: TLS Security Audit
Ticketbleed: A bug in some F5 load balancers that leaks memory through TLS session tickets.Related check: TLS Security Audit

HSTS

HSTS: Tells browsers to only ever connect over HTTPS, so visitors can't be downgraded to plain HTTP.Related check: HSTS
HSTS max-age: How long browsers remember to only use HTTPS. The HSTS preload list needs at least a year.Related check: HSTS
includeSubDomains: Applies HSTS to every subdomain too, so none of them can be reached over plain HTTP.Related check: HSTS
HSTS Preload: Asks browsers to build the site into their HTTPS-only list, protecting even the very first visit.Related check: HSTS

Security headers

Cross-Site Scripting (XSS): Getting a script to run on someone else's site, where it can steal visitors' sessions or act as them.Related check: HTTP Security
Clickjacking: Loading a site in a hidden frame on another page, so visitors click its buttons without realising.Related check: HTTP Security
Content-Security-Policy: Lists where a page may load scripts and other files from, which blocks most cross-site scripting.Related check: HTTP Security
X-Content-Type-Options: Stops browsers guessing a file's type, so an uploaded file can't be run as a script.Related check: HTTP Security
X-Frame-Options: Stops other sites showing this page in a frame, which blocks clickjacking.Related check: HTTP Security
Referrer-Policy: Controls how much of the current URL is shared with other sites when visitors follow links or load files.Related check: HTTP Security
Permissions-Policy: Turns off browser features like the camera, microphone and location for the page and anything it embeds.Related check: HTTP Security
Cross-Origin-Opener-Policy: Keeps the page in its own window group, so pop-ups and other sites can't reach into it.Related check: HTTP Security
Cross-Origin-Resource-Policy: Stops other sites loading this site's files, which guards against Spectre-style data leaks.Related check: HTTP Security
Cross-Origin-Embedder-Policy: Only lets the page load files from other sites that allow it, which unlocks features that need Spectre protection.Related check: HTTP Security
X-XSS-Protection: An old browser filter for cross-site scripting, since removed from browsers. It should now be set to 0.Related check: HTTP Security
Server Software Headers: Headers like Server and X-Powered-By that name the software, and often the version, a site runs.Related check: Headers

Page content

Mixed Content: Files loaded over plain HTTP on an HTTPS page, which can be read or changed in transit.Related check: Mixed Content & SRI
Upgrade Insecure Requests: A CSP setting that makes browsers fetch any HTTP links on the page over HTTPS instead.Related check: Mixed Content & SRI
Third-Party Scripts: Scripts loaded from another company's server, like analytics or chat widgets. They have full access to the page, so whoever controls that server controls part of the site.Related check: Mixed Content & SRI
Subresource Integrity (SRI): An integrity hash on a script or stylesheet lets the browser check the file hasn't been altered, and refuse it if it has.Related check: Mixed Content & SRI
Integrity-Policy: A header that makes browsers refuse any script without an SRI hash.Related check: Mixed Content & SRI
Cookie Security Flags: Secure keeps a cookie off plain HTTP, HttpOnly hides it from scripts, and SameSite stops other sites sending it.Related check: Cookies

Email

SPF: A DNS record listing the servers allowed to send email for the domain, so receivers can spot forged mail.Related check: Email Configuration
DKIM: Signs outgoing email with a key published in DNS, so receivers can check it came from the domain and wasn't changed.Related check: Email Configuration
DMARC: Tells receivers what to do with mail that fails SPF and DKIM, and where to send reports about it.Related check: Email Configuration
BIMI: Shows a brand's logo next to its emails in supported inboxes, once DMARC is enforced.Related check: Email Configuration
MTA-STS: Makes other mail servers use encrypted, verified connections when delivering email to this domain.Related check: Email Configuration
TLS-RPT: Asks other mail servers to report when they fail to deliver mail here securely.Related check: Email Configuration
DANE: Publishes the mail server's certificate details in signed DNS records, so senders can check it without a certificate authority.Related check: Email Configuration

Domains

WHOIS: The public record of a domain's registration: its registrar, key dates, nameservers and, unless hidden, the owner's contact details.Related check: Whois Lookup
WHOIS Privacy: Hides a domain owner's name and contact details from WHOIS, showing the registrar's or a proxy's details instead.Related check: Domain Info
Registrar: The company a domain is registered through, like Namecheap or GoDaddy. Anyone who gets into that account can take control of the domain.Related check: Whois Lookup
Registry: The organisation that runs a whole top-level domain, like Verisign for .com, and keeps the master list of who holds each name.Related check: Whois Lookup
Domain Expiry: The date a domain's registration runs out. If it isn't renewed, the site and its email stop working, and the name can end up with someone else.Related check: Whois Lookup
Subdomain: A name under the main domain, like mail.example.com. Forgotten ones are often left running old, unpatched software.Related check: Subdomains

DNS

DNS Resolver: The server that finds the IP address for a domain when you visit a site. It's usually run by your ISP, or a public service like 1.1.1.1.Related check: Block Detection
A and AAAA Records: Point a domain to its server's IP address. A records hold IPv4 addresses, and AAAA records hold IPv6 ones.Related check: DNS Records
CNAME Record: Makes one domain name an alias for another, often to point a subdomain at a hosting service. If you cancel the service but leave the record, someone else may be able to take over the subdomain.Related check: DNS Records
MX Records: List the servers that receive email for the domain, in order of preference.Related check: DNS Records
NS Records: Name the servers that hold a domain's DNS records. Whoever controls them controls where the domain points.Related check: DNS Server
TXT Records: Free-text DNS records. Sites use them to prove they own a domain, and to publish email policies such as SPF and DMARC.Related check: TXT Records
SOA Record: Holds the basic settings for a domain's DNS, such as its main nameserver, an admin email address, and how often other nameservers check for changes.Related check: DNS Records
PTR Record (Reverse DNS): The reverse of an A record, mapping an IP address back to a hostname. Mail servers often reject email from servers without one.Related check: DNS Records
TTL (Time to Live): How long, in seconds, resolvers may keep a DNS answer before asking again. Long TTLs make lookups faster, but changes take longer to reach everyone.Related check: DNS Records
DNSKEY: The public keys that sign a domain's DNS records under DNSSEC.Related check: DNSSEC
DS Record: A record in the parent zone that points to the domain's DNSKEY, so resolvers can trust its signatures.Related check: DNSSEC
DNSSEC Validation: Whether a resolver could verify the domain's DNS answers were signed and unchanged.Related check: DNSSEC

Hosting and network

IP Address: The number that identifies a server on the internet. DNS turns domain names into these, so people don't have to remember them.Related check: IP Info
Shared Hosting: Many sites running on one server and IP address. It's cheap and common, but if one site gets blocklisted, others on the same IP can be blocked too.Related check: Associated Hosts
ASN (Autonomous System Number): A number for a large network on the internet, usually run by a hosting company, ISP or big business. A server's ASN shows whose network it sits on.Related check: Server Info
IP Geolocation: An estimate of where a server is, based on its IP address. It's usually right about the country, but often wrong about the city.Related check: Server Location
Traceroute: Lists each network hop between you and a server, with the time each one takes. It shows where a connection slows down or breaks.Related check: Traceroute
Content Management System (CMS): Software for building and editing a site without writing code, like WordPress, Drupal or Joomla. Old versions and plugins are a common way in for attackers.Related check: Tech Stack

Threats and reputation

Google Safe Browsing: Google's list of sites known for malware or phishing, which Chrome, Firefox and Safari warn visitors about.Related check: Malware & Phishing
Threat Scan: A scan of the site for malware, phishing and other threats to visitors.Related check: Malware & Phishing
Phishing: Pages that pose as a trusted brand to steal logins, card details or other personal data.Related check: Malware & Phishing
Malware: Software designed to harm visitors or their devices, often spread through hacked sites.Related check: Malware & Phishing
DNS Blocklists: Lists that privacy and family-safety DNS resolvers use to block harmful or unwanted sites.Related check: Block Detection
Data Breaches: Incidents where a site's user data was leaked or stolen, and later made public.Related check: Data Breaches
Known Vulnerabilities (CVEs): Publicly listed security flaws in the software a server runs, each with a CVE number.Related check: Vulnerabilities
Actively Exploited: Flaws on CISA's list of vulnerabilities that attackers are known to be using.Related check: Vulnerabilities
Open Ports: Each open port is a service anyone on the internet can try to connect to, and probe for weaknesses.Related check: Open Ports
Web Application Firewall: A filter in front of a site that blocks common attacks, like SQL injection and bad bots.Related check: Firewall

security.txt

security.txt: A file at /.well-known/security.txt telling security researchers how to report a problem.Related check: Security.txt
Signed security.txt: A PGP signature proves the file came from the site's owner and hasn't been changed.Related check: Security.txt
Contact Field: The required field giving an email address or link for reporting vulnerabilities.Related check: Security.txt
Expires Field: The required date after which the file counts as out of date. It should be under a year ahead.Related check: Security.txt

Quality and visibility

Performance Score: Google Lighthouse's score for how fast the page loads and becomes usable.Related check: Quality Metrics
Accessibility Score: Google Lighthouse's score for how usable the page is for people with disabilities, such as screen reader users.Related check: Quality Metrics
Best Practices Score: Google Lighthouse's score for modern web practices, from using HTTPS to avoiding outdated browser features.Related check: Quality Metrics
SEO Score: Google Lighthouse's score for the basics that help search engines find and show a page.Related check: Quality Metrics
Response Time: How long the server takes to answer. A slow first response delays everything else on the page.Related check: Server Status
HTTP Status Codes: The three-digit number a server sends with every response: 200 means OK, 301 a redirect, 404 not found, and 500 a server error.Related check: Server Status
Redirects: Each redirect sends the browser to another URL, adding a round trip before the page loads.Related check: Redirect Chain
HTTPS Redirect: Sends visitors who arrive over plain HTTP to the secure HTTPS version of the site.Related check: Redirect Chain
Search Engine Crawling: robots.txt can ask search engines to stay away from some or all of a site.Related check: Crawl Rules
AI Crawlers: Bots that fetch pages to train AI models or answer questions, like GPTBot and ClaudeBot. Sites can ask them to stay away in robots.txt, though not all listen.Related check: Crawl Rules
llms.txt: A proposed file at /llms.txt that gives AI tools a short, plain summary of a site and links to its key pages.Related check: Crawl Rules
XML Sitemap: A file listing the pages of a site, so search engines can find them all, including ones nothing links to.Related check: Sitemap
Canonical URL: Tells search engines which URL is the main one when a page can be reached at several addresses, so its ranking isn't split between them.Related check: Social Tags
Open Graph: Tags setting the title, description and image shown when a page is shared on social media or in chat apps.Related check: Social Tags
Twitter Card: Tells X (formerly Twitter) which preview style to use when the page is shared.Related check: Social Tags
Profile Verification: Whether a social profile the site points to also points back, showing the same people run both.Related check: Social Presence
Trackers: Third-party services that record what visitors do, often across many sites.Related check: Trackers & Third Parties
Advertising Trackers: Scripts from ad networks that follow visitors across sites to target ads at them.Related check: Trackers & Third Parties
Analytics: Services that record how visitors use a site, such as the pages they view.Related check: Trackers & Third Parties
Carbon Footprint: An estimate of the CO2 released by the energy used to load a page. Heavier pages use more energy.Related check: Carbon Footprint
Tranco Rank: A site's place in the Tranco list of the top million sites. It combines several other rankings, which makes it harder to game.Related check: Global Ranking
Web Archive: Services like the Wayback Machine that save copies of web pages over time. They show how a site used to look, including things since taken down.Related check: Archive History