Glossary

Security glossary

Plain-English definitions with how to check and how to fix.

CAA record: A CAA (Certification Authority Authorization) record is a DNS record that lists which certificate authorities are allowed to issue certificates for your domain.
Content-Security-Policy (CSP): Content-Security-Policy is an HTTP header that tells browsers which sources of scripts, styles, images and frames your pages are allowed to use.
Data exposure: Data exposure means files or information that should be private, such as environment files, database dumps, backups or source repositories, are reachable by anyone on the internet.
DKIM: DKIM (DomainKeys Identified Mail) attaches a cryptographic signature to outgoing email so receivers can verify it came from your domain and was not altered in transit.
DMARC: DMARC (Domain-based Message Authentication, Reporting and Conformance) is a DNS record that tells receiving mail servers what to do with email that claims to be from your domain but fails SPF and DKIM checks.
DNSSEC: DNSSEC (DNS Security Extensions) adds digital signatures to DNS answers so resolvers can detect forged or tampered responses.
Domain spoofing: Domain spoofing is sending email that forges your exact domain in the From address, without having access to your email accounts.
HSTS: HTTP Strict Transport Security (HSTS) is a response header that tells browsers to only ever connect to your site over HTTPS.
HTTPS: HTTPS is HTTP carried over TLS. It encrypts traffic between your visitors and your website and lets browsers verify they reached the right server.
Lookalike domain: A lookalike domain is a domain name that closely resembles another, using typos, extra words, different extensions or visually similar characters, often to impersonate a brand.
Multi-factor authentication (MFA): Multi-factor authentication requires a second proof of identity, such as a code from an app or a hardware key, in addition to a password.
Phishing: Phishing is a fraud technique where attackers send messages or build websites that impersonate a trusted organization to trick people into revealing credentials, payment details or into installing malware.
Secure and HttpOnly cookies: The Secure flag keeps a cookie from being sent over unencrypted connections, and HttpOnly stops page scripts from reading it, which protects session cookies from theft.
Security headers: Security headers are HTTP response headers that switch on browser protections, such as forcing HTTPS, restricting script sources, or stopping your pages being framed by other sites.
security.txt: security.txt is a plain-text file at /.well-known/security.txt that tells security researchers how to report vulnerabilities to your organization.
SPF: SPF (Sender Policy Framework) is a DNS TXT record that lists the servers allowed to send email on behalf of your domain.
Subdomain takeover: Subdomain takeover happens when a DNS record for one of your subdomains still points at an external service that you no longer use, and someone else can claim that service name and serve content as your subdomain.
TLS: TLS (Transport Layer Security) is the encryption protocol behind HTTPS. It keeps data between a visitor’s browser and your server private and tamper-evident.
Typosquatting: Typosquatting is registering domain names that are common misspellings or mistypings of a legitimate brand’s domain.