Web and WordPress security glossary

B

• 

  Backdoor

  A backdoor is hidden access, built into software or installed after an intrusion, that lets someone get back into a system while bypassing normal…

• 

  bcrypt hashing

  bcrypt is a hashing function designed for storing passwords. It builds in a random salt and an adjustable cost factor that makes each computation…

• 

  Brute-force attack

  A brute-force attack consists of automatically trying a very large number of passwords, or username and password pairs, until one of them unlocks an…

C

• 

  Clickjacking

  Clickjacking means displaying a legitimate site in an invisible frame layered over a booby-trapped page: the victim thinks they are clicking a harmless button…

• 

  Content Security Policy (CSP)

  Content Security Policy (CSP) is an HTTP header through which a site tells the browser which sources of scripts, styles, images or frames it…

• 

  Credential stuffing

  Credential stuffing is an automated attack that replays, on one site, username and password pairs stolen in data breaches at other services. It succeeds…

• 

  CSRF (cross-site request forgery)

  CSRF (cross-site request forgery) is an attack that makes a logged-in user's browser send a request, without their knowledge, to a site where their…

• 

  CVE

  A CVE (Common Vulnerabilities and Exposures) is a unique public identifier, in the form CVE-2024-4577, assigned to a disclosed security vulnerability. This catalog, sponsored…

• 

  CVSS score

  The CVSS score (Common Vulnerability Scoring System) is a rating from 0 to 10 that measures the technical severity of a vulnerability, based on…

D

• 

  DDoS attack

  A DDoS (distributed denial-of-service) attack tries to make a website or server unavailable by flooding it with traffic or requests sent from a large…

F

• 

  File inclusion (LFI / RFI)

  File inclusion is a PHP vulnerability in which an attacker controls the path passed to include or require. With LFI (local file inclusion), they…

• 

  Fingerprinting

  Fingerprinting means identifying the software that runs a website, its version and its components from visible clues: HTTP headers, the generator tag, file paths,…

H

• 

  Honeypot

  A honeypot is a decoy deliberately set up to attract attackers: a fake server, a nonexistent web address or a hidden form field. Since…

• 

  HSTS

  HSTS (HTTP Strict Transport Security) is an HTTP header that tells the browser to contact a site only over HTTPS for a set period…

• 

  HTTP security headers

  HTTP security headers are instructions the server sends with every page and the browser enforces: forcing HTTPS, forbidding display in an external frame, limiting…

I

• 

  IDOR (insecure direct object reference)

  An IDOR (insecure direct object reference) vulnerability lets someone access another user's data simply by changing an identifier in a request, such as an…

• 

  Insecure deserialization

  Insecure deserialization is a vulnerability that occurs when an application rebuilds objects from attacker-controlled data, for example with unserialize() in PHP. The methods triggered…

M

• 

  Malware

  Malware (malicious software) is a program or piece of code introduced into a system to harm its owner or users: stealing data, taking control,…

N

• 

  Nonce

  A nonce is a value, in principle random and used only once, added to an exchange to prevent it from being replayed or forged.…

P

• 

  Password salting

  Password salting means adding a unique random value, the salt, to each password before computing its hash. Two identical passwords then produce different hashes,…

• 

  Phishing

  Phishing is a scam technique that imitates a message from a trusted organization (bank, hosting provider, government agency, online service) to get the victim…

• 

  Privilege escalation

  Privilege escalation is an attack that grants more rights than were originally given: a visitor becomes an administrator, a subscriber changes settings, a customer…

R

• 

  Ransomware

  Ransomware is malicious software that locks access to a system or encrypts its data, then demands a ransom to restore it. Attackers often copy…

• 

  Remote code execution (RCE)

  Remote code execution (RCE) is a vulnerability that lets an attacker make a server run their own instructions over the network, without any legitimate…

S

• 

  SQL injection

  SQL injection is an attack that slips fragments of SQL code into data sent to a website in order to hijack the query the…

• 

  SSRF (server-side request forgery)

  An SSRF (server-side request forgery) vulnerability lets an attacker make the server send requests to an address of their choosing: internal services, the cloud…

• 

  Supply chain attack

  A supply chain attack compromises a software vendor, a dependency or an update channel in order to reach that vendor's customers. The malicious code…

T

• 

  TLS / SSL

  TLS (Transport Layer Security) is the protocol that encrypts traffic between a browser and a server, guarantees its integrity and authenticates the server through…

• 

  TLS certificate

  A TLS certificate is an electronic file that binds a domain name to a public key, signed by a certificate authority that browsers trust.…

• 

  Two-factor authentication (2FA)

  Two-factor authentication (2FA) adds a second proof of identity to the password at login: a temporary code generated by an app, a security key…

U

• 

  User enumeration

  User enumeration is a reconnaissance technique that builds a list of a site's valid usernames by exploiting its responses: error messages, author URLs, public…

V

• 

  Virtual patching

  Virtual patching is a filtering rule that blocks the exploitation of a specific vulnerability without changing the code of the affected software. Applied by…

W

• 

  WAF (web application firewall)

  A WAF (web application firewall) is a filter placed in front of a web application that inspects every HTTP request (URL, parameters, headers, body)…

X

• 

  XML-RPC

  XML-RPC is a protocol for calling functions remotely through XML messages. In WordPress, the xmlrpc.php file lets you publish from an external application and…

• 

  XSS (cross-site scripting)

  XSS (cross-site scripting) is a vulnerability that lets an attacker run their own JavaScript in the page another visitor is viewing. The script then…

Z

• 

  Zero-day vulnerability

  A zero-day vulnerability is a security flaw exploited by attackers before the software vendor has fixed it, and often before the vendor even knows…