Web security glossary

Quick reference for the terms used for website security and OSINT.

Certificates

Certificate Authority (CA): An organisation such as Let's Encrypt that browsers trust to issue certificates. It checks who controls a domain before issuing one.See the SSL Certificate check
Certificate Trust: Whether the certificate is valid for this hostname and was issued by an authority browsers trust.See the SSL Certificate check
Certificate Expiry: Certificates are only valid until their expiry date, after which browsers refuse them.See the SSL Certificate check
Subject Alternative Names (SANs): The hostnames a certificate covers. Browsers show a warning if the site's name isn't one of them.See the SSL Certificate check
Certificate Fingerprint: A hash of the whole certificate. If two fingerprints match, it's the same certificate.See the SSL Certificate check
Certificate Transparency: Public logs of every certificate issued, so one issued by mistake or by an attacker gets noticed.See the TLS Security Audit check
CAA Records: DNS records naming which certificate authorities may issue certificates for the domain.See the CAA Records check

TLS

HTTPS: The secure version of HTTP. It sends pages over an encrypted connection, so others on the network can't read or change them.See the TLS Connection check
TLS and SSL: The encryption behind HTTPS. SSL was the version before it, retired years ago, but the name lives on in "SSL certificate".See the TLS Connection check
TLS Handshake: The first few messages of a secure connection, where the browser and server agree on settings, swap keys and check the certificate.See the TLS Connection check
Cipher Suite: The mix of algorithms used to encrypt and protect a connection, agreed during the handshake. Older suites have known weaknesses.See the TLS Connection check
TLS Version: The version of TLS the connection used. Newer versions are faster and drop weaker encryption.See the TLS Connection check
TLS 1.3: The newest version of TLS, with a faster handshake and only strong encryption.See the TLS Connection check
TLS 1.0 and 1.1: Old versions of TLS with known weaknesses, which every major browser dropped in 2020.See the TLS Connection check
SSL Labs Grade: Qualys SSL Labs' overall rating of a server's HTTPS setup, from A+ down to F.See the TLS Security Audit check
Forward Secrecy: Each connection gets its own temporary key, so a stolen server key can't decrypt past traffic.See the TLS Connection check
Session Resumption: Returning visitors can reuse an earlier secure session, skipping part of the handshake.See the TLS Connection check
OCSP Stapling: The server attaches proof that its certificate hasn't been revoked, so browsers don't have to ask the issuer.See the TLS Connection check
HTTP/2: A faster version of HTTP that loads many files at once over a single connection.See the TLS Connection check
ALPN: Lets the browser and server pick a protocol, such as HTTP/2, inside the TLS handshake, which saves a round trip.See the TLS Connection check
Renegotiation: Lets the browser and server agree new settings partway through a connection. Only the secure kind is safe.See the TLS Security Audit check
Fallback SCSV: Stops attackers forcing a connection down to an older, weaker version of TLS.See the TLS Security Audit check
ChaCha20: A cipher that runs faster than AES on phones and other devices without AES hardware.See the TLS Security Audit check
AEAD Ciphers: Modern ciphers like AES-GCM and ChaCha20, which encrypt and check data in one step to avoid a whole class of attacks.See the TLS Security Audit check
CBC Ciphers: An older cipher mode behind attacks like POODLE and Lucky 13.See the TLS Security Audit check
TLS Compression: Compressing data before encrypting it, which the CRIME attack uses to steal cookies.See the TLS Security Audit check
Key Exchange Reuse: Reusing the same temporary key exchange values across connections, which weakens forward secrecy.See the TLS Security Audit check
Weak DH Primes: Widely shared Diffie-Hellman groups that are too small, so a well-funded attacker may already have broken them.See the TLS Security Audit check
Client Compatibility: Whether a browser or device can complete a secure connection to the site.See the TLS Client Compatibility check

TLS vulnerabilities

Downgrade Attack: Tricking a connection into using an older, weaker protocol or cipher, so it's easier to break.See the TLS Security Audit check
Padding Oracle: A flaw where a server responds differently to badly padded data. By sending thousands of altered messages, attackers can use those replies to decrypt traffic.See the TLS Security Audit check
Heartbleed: A bug in old OpenSSL versions that let anyone read server memory, including private keys and passwords.See the TLS Security Audit check
POODLE: An attack on SSL 3.0 that decrypts data a byte at a time. Disabling SSL 3.0 fixes it.See the TLS Security Audit check
POODLE (TLS): A version of POODLE that works against TLS servers which don't check padding properly.See the TLS Security Audit check
Zombie POODLE: A padding oracle in some servers that brings POODLE-style attacks back to CBC ciphers.See the TLS Security Audit check
GOLDENDOODLE: A faster padding oracle attack on CBC ciphers, found in some firewalls and load balancers.See the TLS Security Audit check
Sleeping POODLE: Another padding oracle on CBC ciphers, found in some network devices.See the TLS Security Audit check
Zero-Length Padding Oracle: An OpenSSL bug (CVE-2019-1559) that lets an attacker decrypt traffic on CBC ciphers.See the TLS Security Audit check
FREAK: Tricks a connection into using deliberately weak 1990s export encryption, which can be cracked in hours.See the TLS Security Audit check
Logjam: Downgrades the key exchange to weak Diffie-Hellman groups that can be broken.See the TLS Security Audit check
DROWN: Uses any server that still supports SSL 2.0 with the same key to decrypt modern TLS traffic.See the TLS Security Audit check
CCS Injection: An OpenSSL bug (CVE-2014-0224) that lets an attacker force weak keys and read traffic.See the TLS Security Audit check
OpenSSL Padding Oracle: An OpenSSL bug (CVE-2016-2107) that lets an attacker decrypt AES-CBC traffic.See the TLS Security Audit check
ROBOT: A revived attack on RSA key exchange that can decrypt traffic, or sign messages with the server's key.See the TLS Security Audit check
Ticketbleed: A bug in some F5 load balancers that leaks memory through TLS session tickets.See the TLS Security Audit check

HSTS

HSTS: Tells browsers to only ever connect over HTTPS, so visitors can't be downgraded to plain HTTP.See the HSTS check
HSTS max-age: How long browsers remember to only use HTTPS. The HSTS preload list needs at least a year.See the HSTS check
includeSubDomains: Applies HSTS to every subdomain too, so none of them can be reached over plain HTTP.See the HSTS check
HSTS Preload: Asks browsers to build the site into their HTTPS-only list, protecting even the very first visit.See the HSTS check

Security headers

Cross-Site Scripting (XSS): Getting a script to run on someone else's site, where it can steal visitors' sessions or act as them.See the HTTP Security check
Clickjacking: Loading a site in a hidden frame on another page, so visitors click its buttons without realising.See the HTTP Security check
Content-Security-Policy: Lists where a page may load scripts and other files from, which blocks most cross-site scripting.See the HTTP Security check
X-Content-Type-Options: Stops browsers guessing a file's type, so an uploaded file can't be run as a script.See the HTTP Security check
X-Frame-Options: Stops other sites showing this page in a frame, which blocks clickjacking.See the HTTP Security check
Referrer-Policy: Controls how much of the current URL is shared with other sites when visitors follow links or load files.See the HTTP Security check
Permissions-Policy: Turns off browser features like the camera, microphone and location for the page and anything it embeds.See the HTTP Security check
Cross-Origin-Opener-Policy: Keeps the page in its own window group, so pop-ups and other sites can't reach into it.See the HTTP Security check
Cross-Origin-Resource-Policy: Stops other sites loading this site's files, which guards against Spectre-style data leaks.See the HTTP Security check
Cross-Origin-Embedder-Policy: Only lets the page load files from other sites that allow it, which unlocks features that need Spectre protection.See the HTTP Security check
X-XSS-Protection: An old browser filter for cross-site scripting, since removed from browsers. It should now be set to 0.See the HTTP Security check
Server Software Headers: Headers like Server and X-Powered-By that name the software, and often the version, a site runs.See the Headers check

Page content

Mixed Content: Files loaded over plain HTTP on an HTTPS page, which can be read or changed in transit.See the Mixed Content & SRI check
Upgrade Insecure Requests: A CSP setting that makes browsers fetch any HTTP links on the page over HTTPS instead.See the Mixed Content & SRI check
Third-Party Scripts: Scripts loaded from another company's server, like analytics or chat widgets. They have full access to the page, so whoever controls that server controls part of the site.See the Mixed Content & SRI check
Subresource Integrity (SRI): An integrity hash on a script or stylesheet lets the browser check the file hasn't been altered, and refuse it if it has.See the Mixed Content & SRI check
Integrity-Policy: A header that makes browsers refuse any script without an SRI hash.See the Mixed Content & SRI check
Cookie Security Flags: Secure keeps a cookie off plain HTTP, HttpOnly hides it from scripts, and SameSite stops other sites sending it.See the Cookies check

Email

SPF: A DNS record listing the servers allowed to send email for the domain, so receivers can spot forged mail.See the Email Configuration check
DKIM: Signs outgoing email with a key published in DNS, so receivers can check it came from the domain and wasn't changed.See the Email Configuration check
DMARC: Tells receivers what to do with mail that fails SPF and DKIM, and where to send reports about it.See the Email Configuration check
BIMI: Shows a brand's logo next to its emails in supported inboxes, once DMARC is enforced.See the Email Configuration check
MTA-STS: Makes other mail servers use encrypted, verified connections when delivering email to this domain.See the Email Configuration check
TLS-RPT: Asks other mail servers to report when they fail to deliver mail here securely.See the Email Configuration check
DANE: Publishes the mail server's certificate details in signed DNS records, so senders can check it without a certificate authority.See the Email Configuration check

Domains

WHOIS: The public record of a domain's registration: its registrar, key dates, nameservers and, unless hidden, the owner's contact details.See the Whois Lookup check
WHOIS Privacy: Hides a domain owner's name and contact details from WHOIS, showing the registrar's or a proxy's details instead.See the Domain Info check
Registrar: The company a domain is registered through, like Namecheap or GoDaddy. Anyone who gets into that account can take control of the domain.See the Whois Lookup check
Registry: The organisation that runs a whole top-level domain, like Verisign for .com, and keeps the master list of who holds each name.See the Whois Lookup check
Domain Expiry: The date a domain's registration runs out. If it isn't renewed, the site and its email stop working, and the name can end up with someone else.See the Whois Lookup check
Subdomain: A name under the main domain, like mail.example.com. Forgotten ones are often left running old, unpatched software.See the Subdomains check

DNS

DNS Resolver: The server that finds the IP address for a domain when you visit a site. It's usually run by your ISP, or a public service like 1.1.1.1.See the Block Detection check
A and AAAA Records: Point a domain to its server's IP address. A records hold IPv4 addresses, and AAAA records hold IPv6 ones.See the DNS Records check
CNAME Record: Makes one domain name an alias for another, often to point a subdomain at a hosting service. If you cancel the service but leave the record, someone else may be able to take over the subdomain.See the DNS Records check
MX Records: List the servers that receive email for the domain, in order of preference.See the DNS Records check
NS Records: Name the servers that hold a domain's DNS records. Whoever controls them controls where the domain points.See the DNS Server check
TXT Records: Free-text DNS records. Sites use them to prove they own a domain, and to publish email policies such as SPF and DMARC.See the TXT Records check
SOA Record: Holds the basic settings for a domain's DNS, such as its main nameserver, an admin email address, and how often other nameservers check for changes.See the DNS Records check
PTR Record (Reverse DNS): The reverse of an A record, mapping an IP address back to a hostname. Mail servers often reject email from servers without one.See the DNS Records check
TTL (Time to Live): How long, in seconds, resolvers may keep a DNS answer before asking again. Long TTLs make lookups faster, but changes take longer to reach everyone.See the DNS Records check
DNSKEY: The public keys that sign a domain's DNS records under DNSSEC.See the DNSSEC check
DS Record: A record in the parent zone that points to the domain's DNSKEY, so resolvers can trust its signatures.See the DNSSEC check
DNSSEC Validation: Whether a resolver could verify the domain's DNS answers were signed and unchanged.See the DNSSEC check

Hosting and network

IP Address: The number that identifies a server on the internet. DNS turns domain names into these, so people don't have to remember them.See the IP Info check
Shared Hosting: Many sites running on one server and IP address. It's cheap and common, but if one site gets blocklisted, others on the same IP can be blocked too.See the Associated Hosts check
ASN (Autonomous System Number): A number for a large network on the internet, usually run by a hosting company, ISP or big business. A server's ASN shows whose network it sits on.See the Server Info check
IP Geolocation: An estimate of where a server is, based on its IP address. It's usually right about the country, but often wrong about the city.See the Server Location check
Traceroute: Lists each network hop between you and a server, with the time each one takes. It shows where a connection slows down or breaks.See the Traceroute check
Content Management System (CMS): Software for building and editing a site without writing code, like WordPress, Drupal or Joomla. Old versions and plugins are a common way in for attackers.See the Tech Stack check

Threats and reputation

Google Safe Browsing: Google's list of sites known for malware or phishing, which Chrome, Firefox and Safari warn visitors about.See the Malware & Phishing check
Threat Scan: A scan of the site for malware, phishing and other threats to visitors.See the Malware & Phishing check
Phishing: Pages that pose as a trusted brand to steal logins, card details or other personal data.See the Malware & Phishing check
Malware: Software designed to harm visitors or their devices, often spread through hacked sites.See the Malware & Phishing check
DNS Blocklists: Lists that privacy and family-safety DNS resolvers use to block harmful or unwanted sites.See the Block Detection check
Data Breaches: Incidents where a site's user data was leaked or stolen, and later made public.See the Data Breaches check
Known Vulnerabilities (CVEs): Publicly listed security flaws in the software a server runs, each with a CVE number.See the Vulnerabilities check
Actively Exploited: Flaws on CISA's list of vulnerabilities that attackers are known to be using.See the Vulnerabilities check
Open Ports: Each open port is a service anyone on the internet can try to connect to, and probe for weaknesses.See the Open Ports check
Web Application Firewall: A filter in front of a site that blocks common attacks, like SQL injection and bad bots.See the Firewall check

security.txt

security.txt: A file at /.well-known/security.txt telling security researchers how to report a problem.See the Security.txt check
Signed security.txt: A PGP signature proves the file came from the site's owner and hasn't been changed.See the Security.txt check
Contact Field: The required field giving an email address or link for reporting vulnerabilities.See the Security.txt check
Expires Field: The required date after which the file counts as out of date. It should be under a year ahead.See the Security.txt check

Quality and visibility

Performance Score: Google Lighthouse's score for how fast the page loads and becomes usable.See the Quality Metrics check
Accessibility Score: Google Lighthouse's score for how usable the page is for people with disabilities, such as screen reader users.See the Quality Metrics check
Best Practices Score: Google Lighthouse's score for modern web practices, from using HTTPS to avoiding outdated browser features.See the Quality Metrics check
SEO Score: Google Lighthouse's score for the basics that help search engines find and show a page.See the Quality Metrics check
Response Time: How long the server takes to answer. A slow first response delays everything else on the page.See the Server Status check
HTTP Status Codes: The three-digit number a server sends with every response: 200 means OK, 301 a redirect, 404 not found, and 500 a server error.See the Server Status check
Redirects: Each redirect sends the browser to another URL, adding a round trip before the page loads.See the Redirect Chain check
HTTPS Redirect: Sends visitors who arrive over plain HTTP to the secure HTTPS version of the site.See the Redirect Chain check
Search Engine Crawling: robots.txt can ask search engines to stay away from some or all of a site.See the Crawl Rules check
AI Crawlers: Bots that fetch pages to train AI models or answer questions, like GPTBot and ClaudeBot. Sites can ask them to stay away in robots.txt, though not all listen.See the Crawl Rules check
llms.txt: A proposed file at /llms.txt that gives AI tools a short, plain summary of a site and links to its key pages.See the Crawl Rules check
XML Sitemap: A file listing the pages of a site, so search engines can find them all, including ones nothing links to.See the Sitemap check
Canonical URL: Tells search engines which URL is the main one when a page can be reached at several addresses, so its ranking isn't split between them.See the Social Tags check
Open Graph: Tags setting the title, description and image shown when a page is shared on social media or in chat apps.See the Social Tags check
Twitter Card: Tells X (formerly Twitter) which preview style to use when the page is shared.See the Social Tags check
Profile Verification: Whether a social profile the site points to also points back, showing the same people run both.See the Social Presence check
Trackers: Third-party services that record what visitors do, often across many sites.See the Trackers & Third Parties check
Advertising Trackers: Scripts from ad networks that follow visitors across sites to target ads at them.See the Trackers & Third Parties check
Analytics: Services that record how visitors use a site, such as the pages they view.See the Trackers & Third Parties check
Carbon Footprint: An estimate of the CO2 released by the energy used to load a page. Heavier pages use more energy.See the Carbon Footprint check
Tranco Rank: A site's place in the Tranco list of the top million sites. It combines several other rankings, which makes it harder to game.See the Global Ranking check
Web Archive: Services like the Wayback Machine that save copies of web pages over time. They show how a site used to look, including things since taken down.See the Archive History check