Glossary
Terms you may come across in a security report or a talk with your developer, explained briefly and without jargon.
- Two-factor authentication (2FA)
- An extra step when logging in, such as a code on your phone. Even if a password is stolen, an attacker cannot get in without the second step.
- API
- An entry point where programs talk to each other, for example when an app fetches data from your server. An API needs the same protection as the website itself, because this is often where data can be pulled out around the login.
- CORS
- Rules for which other websites may fetch data from your site through a visitor’s browser. If the rules are too loose, a foreign site can read information meant only for your users.
- CSP
- Short for Content Security Policy. A list that tells the browser where your site may load scripts, images and other content from. Everything else is blocked, which makes many attacks much harder.
- CVE
- A number given to a known vulnerability in a piece of software, such as CVE‑2024‑1234. The number makes it easy to look up how serious the flaw is and whether a fix exists.
- Pentest
- Short for penetration test. I test your system the way an attacker would, but with your written permission and within agreed limits, so you learn about the holes before a real attacker does.
- Phishing
- Fake emails or messages that try to trick the recipient into clicking a link, logging in on a fake page or paying a fake invoice. They often pretend to come from a well-known company.
- Retest
- A new test of the findings you have fixed. It shows that the fixes work and have not opened new holes. The retest is included in every package.
- Risk score
- A number from 0 to 10 that shows how serious a finding is. It is calculated using a recognised standard and then assessed manually, so you can see what to fix first.
- Security headers
- Small instructions your server sends with every page. They ask the browser to turn on protection, such as only using an encrypted connection and not letting other sites show your page in a frame.
- Source code review (SAST)
- A review of the code behind your site or app. It finds flaws that cannot be seen from the outside, such as passwords written directly into the code. SAST is the short name for the method.
- SPF, DKIM and DMARC
- Three settings on your domain that decide who may send email in your name. Without them, scammers can send emails that appear to come from you.
- SQL injection
- An attack where someone types code into, say, a search field or login form, so the database runs commands it should not. In the worst case, the whole customer database can be pulled out.
- TLS and HTTPS
- The encryption that protects the connection between the visitor and your site. It is what gives you the padlock in the browser. Outdated settings can make the encryption weaker than it looks.
- XSS
- Short for cross-site scripting. A flaw where an attacker can make their own code run on your site in other visitors’ browsers, for example to steal a login or change what they see.
Is there a term in your report that is not here?
Write to me, and I will explain it. That is part of the job.
Get a quote
Reply within 1-2 working days.