---
title: "Web and WordPress security glossary"
description: "Vulnerabilities, attacks and defenses explained: XSS, SQL injection, brute force, WAF, 2FA, CVE, security headers and WordPress good practice."
language: "en"
locale: "en-US"
type: "glossary"
canonical: "https://www.wp-masquerade.com/glossary/web-security/"
published: ""
modified: "2026-11-05T20:54:48+00:00"
translations:
  en-US: "https://www.wp-masquerade.com/glossary/web-security/index.md"
  fr-FR: "https://www.wp-masquerade.com/fr/definitions/securite-web/index.md"
  es-ES: "https://www.wp-masquerade.com/es/glosario/seguridad-web/index.md"
  de-DE: "https://www.wp-masquerade.com/de/glossar/web-sicherheit/index.md"
  it-IT: "https://www.wp-masquerade.com/it/glossario/sicurezza-web/index.md"
  pt-BR: "https://www.wp-masquerade.com/pt/glossario/seguranca-web/index.md"
  nl-NL: "https://www.wp-masquerade.com/nl/woordenlijst/webbeveiliging/index.md"
---

# Web and WordPress security glossary

Vulnerabilities, attacks and defenses explained: XSS, SQL injection, brute force, WAF, 2FA, CVE, security headers and WordPress good practice.

## Web security

- [Backdoor](https://www.wp-masquerade.com/glossary/backdoor/): A backdoor is hidden access, built into software or installed after an intrusion, that lets someone get back into a system while bypassing normal authentication. On a website, it often takes the form of a small PHP file, code added to a theme or an inconspicuous administrator account.
- [bcrypt hashing](https://www.wp-masquerade.com/glossary/bcrypt/): bcrypt is a hashing function designed for storing passwords. It builds in a random salt and an adjustable cost factor that makes each computation deliberately slow, which greatly hinders attacks on a stolen database. WordPress has used it by default since version 6.8.
- [Brute-force attack](https://www.wp-masquerade.com/glossary/brute-force-attack/): A brute-force attack consists of automatically trying a very large number of passwords, or username and password pairs, until one of them unlocks an account. On WordPress, bots run these attacks around the clock against the login page and XML-RPC.
- [Clickjacking](https://www.wp-masquerade.com/glossary/clickjacking/): Clickjacking means displaying a legitimate site in an invisible frame layered over a booby-trapped page: the victim thinks they are clicking a harmless button but actually triggers an action on the hidden site, with their own session. The frame-ancestors and X-Frame-Options headers prevent it.
- [Content Security Policy (CSP)](https://www.wp-masquerade.com/glossary/content-security-policy/): Content Security Policy (CSP) is an HTTP header through which a site tells the browser which sources of scripts, styles, images or frames it is allowed to load. Anything outside that list is blocked, which greatly limits the impact of a cross-site scripting (XSS) vulnerability.
- [Credential stuffing](https://www.wp-masquerade.com/glossary/credential-stuffing/): Credential stuffing is an automated attack that replays, on one site, username and password pairs stolen in data breaches at other services. It succeeds as soon as a user has reused the same password elsewhere, without the attacker having to guess anything.
- [CSRF (cross-site request forgery)](https://www.wp-masquerade.com/glossary/csrf/): CSRF (cross-site request forgery) is an attack that makes a logged-in user's browser send a request, without their knowledge, to a site where their session is open. The site believes it is a deliberate action: email address changed, setting modified, account created.
- [CVE](https://www.wp-masquerade.com/glossary/cve/): A CVE (Common Vulnerabilities and Exposures) is a unique public identifier, in the form CVE-2024-4577, assigned to a disclosed security vulnerability. This catalog, sponsored by the US agency CISA, lets vendors, researchers and security tools refer to the same flaw without ambiguity.
- [CVSS score](https://www.wp-masquerade.com/glossary/cvss/): The CVSS score (Common Vulnerability Scoring System) is a rating from 0 to 10 that measures the technical severity of a vulnerability, based on standardized criteria such as the attack vector, the privileges required or the impact. Maintained by FIRST, it exists in versions 3.1 and 4.0.
- [DDoS attack](https://www.wp-masquerade.com/glossary/ddos-attack/): A DDoS (distributed denial-of-service) attack tries to make a website or server unavailable by flooding it with traffic or requests sent from a large number of machines, often hacked devices grouped into a botnet. The service slows down dramatically or stops responding to legitimate visitors.
- [File inclusion (LFI / RFI)](https://www.wp-masquerade.com/glossary/file-inclusion/): File inclusion is a PHP vulnerability in which an attacker controls the path passed to include or require. With LFI (local file inclusion), they load a file already on the server; with RFI (remote file inclusion), a file hosted elsewhere. It leads to leaked secrets or code execution.
- [Fingerprinting](https://www.wp-masquerade.com/glossary/fingerprinting/): Fingerprinting means identifying the software that runs a website, its version and its components from visible clues: HTTP headers, the generator tag, file paths, cookies. Bots use it to pick which known vulnerabilities to try on each site.
- [Honeypot](https://www.wp-masquerade.com/glossary/honeypot/): A honeypot is a decoy deliberately set up to attract attackers: a fake server, a nonexistent web address or a hidden form field. Since no legitimate user should ever reach it, every interaction points to a bot or an intruder that can be observed, counted or blocked.
- [HSTS](https://www.wp-masquerade.com/glossary/hsts/): HSTS (HTTP Strict Transport Security) is an HTTP header that tells the browser to contact a site only over HTTPS for a set period of time. After the first secure visit, any HTTP URL is converted to HTTPS before the request is sent, and certificate errors can no longer be bypassed.
- [HTTP security headers](https://www.wp-masquerade.com/glossary/http-security-headers/): HTTP security headers are instructions the server sends with every page and the browser enforces: forcing HTTPS, forbidding display in an external frame, limiting allowed scripts or the information passed along. They protect visitors without fixing vulnerabilities in the site itself.
- [IDOR (insecure direct object reference)](https://www.wp-masquerade.com/glossary/idor/): An IDOR (insecure direct object reference) vulnerability lets someone access another user's data simply by changing an identifier in a request, such as an order number in the URL, because the application doesn't check that the requested object actually belongs to the logged-in user.
- [Insecure deserialization](https://www.wp-masquerade.com/glossary/insecure-deserialization/): Insecure deserialization is a vulnerability that occurs when an application rebuilds objects from attacker-controlled data, for example with unserialize() in PHP. The methods triggered automatically during this rebuilding can lead to file deletion or code execution.
- [Malware](https://www.wp-masquerade.com/glossary/malware/): Malware (malicious software) is a program or piece of code introduced into a system to harm its owner or users: stealing data, taking control, encrypting files, sending spam or redirecting visitors. Viruses, worms, Trojans and ransomware are all forms of malware.
- [Nonce](https://www.wp-masquerade.com/glossary/nonce/): A nonce is a value, in principle random and used only once, added to an exchange to prevent it from being replayed or forged. In WordPress, a nonce is a token tied to an action, a user and their session, valid for 12 to 24 hours, mainly used to protect against CSRF attacks.
- [Password salting](https://www.wp-masquerade.com/glossary/password-salting/): Password salting means adding a unique random value, the salt, to each password before computing its hash. Two identical passwords then produce different hashes, which makes precomputed tables useless and forces an attacker to crack each account separately.
- [Phishing](https://www.wp-masquerade.com/glossary/phishing/): Phishing is a scam technique that imitates a message from a trusted organization (bank, hosting provider, government agency, online service) to get the victim to click, then hand over their login credentials, bank details or other personal data on a fake website.
- [Privilege escalation](https://www.wp-masquerade.com/glossary/privilege-escalation/): Privilege escalation is an attack that grants more rights than were originally given: a visitor becomes an administrator, a subscriber changes settings, a customer reads another customer's data. It exploits a vulnerability, a missing access check or a misconfiguration.
- [Ransomware](https://www.wp-masquerade.com/glossary/ransomware/): Ransomware is malicious software that locks access to a system or encrypts its data, then demands a ransom to restore it. Attackers often copy the data before encrypting it and threaten to publish it to increase the pressure: this is known as double extortion.
- [Remote code execution (RCE)](https://www.wp-masquerade.com/glossary/remote-code-execution/): Remote code execution (RCE) is a vulnerability that lets an attacker make a server run their own instructions over the network, without any legitimate access to it. It is one of the most severe types of vulnerability, because it often leads to a complete takeover of the site.
- [SQL injection](https://www.wp-masquerade.com/glossary/sql-injection/): SQL injection is an attack that slips fragments of SQL code into data sent to a website in order to hijack the query the site sends to its database. It can be used to read, modify or delete data, and sometimes to bypass authentication.
- [SSRF (server-side request forgery)](https://www.wp-masquerade.com/glossary/ssrf/): An SSRF (server-side request forgery) vulnerability lets an attacker make the server send requests to an address of their choosing: internal services, the cloud metadata endpoint or the server itself, all normally unreachable from the internet.
- [Supply chain attack](https://www.wp-masquerade.com/glossary/supply-chain-attack/): A supply chain attack compromises a software vendor, a dependency or an update channel in order to reach that vendor's customers. The malicious code then arrives through a trusted path, for example the official update of a WordPress plugin.
- [TLS / SSL](https://www.wp-masquerade.com/glossary/tls-ssl/): TLS (Transport Layer Security) is the protocol that encrypts traffic between a browser and a server, guarantees its integrity and authenticates the server through its certificate. It replaced SSL, now obsolete, and it is what puts the “S” in HTTPS. The current version is TLS 1.3.
- [TLS certificate](https://www.wp-masquerade.com/glossary/tls-certificate/): A TLS certificate is an electronic file that binds a domain name to a public key, signed by a certificate authority that browsers trust. It lets visitors verify that they are talking to the right server before an encrypted HTTPS connection is established.
- [Two-factor authentication (2FA)](https://www.wp-masquerade.com/glossary/two-factor-authentication/): Two-factor authentication (2FA) adds a second proof of identity to the password at login: a temporary code generated by an app, a security key or a notification on a trusted device. A stolen or guessed password is then no longer enough to get into the account.
- [User enumeration](https://www.wp-masquerade.com/glossary/user-enumeration/): User enumeration is a reconnaissance technique that builds a list of a site's valid usernames by exploiting its responses: error messages, author URLs, public APIs. The attacker then focuses password-guessing attempts on these real accounts.
- [Virtual patching](https://www.wp-masquerade.com/glossary/virtual-patching/): Virtual patching is a filtering rule that blocks the exploitation of a specific vulnerability without changing the code of the affected software. Applied by a web application firewall, the web server or a security agent, a virtual patch protects a site until the real update is installed.
- [WAF (web application firewall)](https://www.wp-masquerade.com/glossary/waf/): A WAF (web application firewall) is a filter placed in front of a web application that inspects every HTTP request (URL, parameters, headers, body) and blocks those that match known attacks, such as SQL injection or cross-site scripting.
- [XML-RPC](https://www.wp-masquerade.com/glossary/xml-rpc/): XML-RPC is a protocol for calling functions remotely through XML messages. In WordPress, the xmlrpc.php file lets you publish from an external application and receive pingbacks; enabled by default, it is also a frequent target of password-guessing attempts and pingback abuse.
- [XSS (cross-site scripting)](https://www.wp-masquerade.com/glossary/xss/): XSS (cross-site scripting) is a vulnerability that lets an attacker run their own JavaScript in the page another visitor is viewing. The script then acts in the victim's browser with the site's privileges: performing actions on their behalf, reading the data on screen or redirecting them.
- [Zero-day vulnerability](https://www.wp-masquerade.com/glossary/zero-day/): A zero-day vulnerability is a security flaw exploited by attackers before the software vendor has fixed it, and often before the vendor even knows it exists. No update can protect the site at that point: only other layers of defense reduce the risk.