Terms and abbreviations

2FA

two-factor authentication

Logging in with two independent proofs, for example a password and a code from an app. A stolen password alone is then no longer enough.

4K

A screen resolution of about 4,000 pixels in width, for monitors and televisions usually 3840 × 2160 pixels (also called UHD).

5xx

status codes 500 to 599

Shorthand for HTTP status codes by their first digit: 2xx means success, 3xx redirect, 4xx an error in the request (such as 404, page not found) and 5xx an error on the server. 1xx are interim responses.

A/B test

A comparison of two versions of a page: visitors randomly see version A or B, and the test measures which one reaches its goal better.

AAAA

IPv6 address record in DNS

A DNS record that assigns an IPv6 address to a domain. It is the counterpart of the A record, which points to an IPv4 address.

Pronunciation: usually "quad A"

ABC

Audit Bureau of Circulations

A British organisation that audits media reach. Together with the IAB it publishes a list of known bots and spiders that can be used to filter automated traffic out of statistics.

Abmahnung

A German legal term for a formal written demand to stop a legal violation, usually combined with a cease-and-desist declaration and costs. Triggers can be, for example, a faulty legal notice or a non-compliant cookie banner. This explanation does not replace legal advice.

Accessibility statement

A page on which a provider describes how far its offering is accessible, which shortcomings are known and how to report them. Public bodies have to publish such a statement; under the German Accessibility Strengthening Act (BFSG), many companies also have to provide information on the accessibility of their offerings. This explanation does not replace legal advice.

ACK

Acknowledgement

Confirmation of receipt. In the TCP connection setup, ACK is the packet with which one side confirms receipt; for alerts, it is the acknowledgement by the person on call.

ACM

Association for Computing Machinery

An international professional association for computing. It organises conferences, for example the Internet Measurement Conference (IMC), whose studies are often cited as a source of internet measurements.

ACME

Automatic Certificate Management Environment

A procedure with which a server automatically requests certificates from a certificate authority and renews them in time without anyone having to step in. Let's Encrypt, for example, works with it.

AD

Authenticated Data

A flag in a DNS answer that a validating resolver sets when it has successfully checked the DNSSEC signatures.

Ad blocker

A browser extension or setting that hides advertising and often also blocks tracking scripts. Such visits are then sometimes missing from web analytics.

adequacy decision

A decision by the EU Commission that a country outside the EU protects personal data about as well as the EU does. Data may then be transferred there without further safeguards. This explanation does not replace legal advice.

AEAD

Authenticated Encryption with Associated Data

A type of encryption that both encrypts data and protects it against unnoticed changes. TLS 1.3 only allows such methods, for example AES-GCM.

AEPD

Agencia Española de Protección de Datos

The Spanish data protection authority. It supervises compliance with the GDPR in Spain and can impose fines.

AES

Advanced Encryption Standard

A widely used method for encrypting data with a shared key. It protects, for example, the data of an HTTPS connection after the browser and server have agreed on a key.

AFRINIC

African Network Information Centre

The regional registry for IP addresses and AS numbers in Africa, one of the five Regional Internet Registries.

AG

Aktiengesellschaft (German stock corporation)

Aktiengesellschaft, the German legal form of a stock corporation, whose capital is divided into shares. In the legal notice, the suffix AG is part of the full company name.

AGB

Allgemeine Geschäftsbedingungen (general terms and conditions)

Pre-formulated contract terms that a provider uses for many contracts, for example on delivery, payment and cancellation. As a rule, they only apply if the customer was referred to them before the contract was concluded. This explanation does not replace legal advice.

AI

artificial intelligence

Methods with which computers solve tasks that would otherwise need human thinking, for example understanding and writing text or recognising patterns in data.

AIA

Authority Information Access

A field in a certificate that says where further information about the issuer can be found: the address of the intermediate certificate and, if present, the address for the OCSP revocation check.

AJAX

Asynchronous JavaScript and XML

A technique with which a web page loads data in the background and updates only parts of the page, for example a shopping cart or search results. The address in the address bar often does not change.

Alert

A notification that a monitoring service sends when something is wrong, for example by email, text message or chat. Alerting means setting up and sending such notifications.

ALPN

Application-Layer Protocol Negotiation

A TLS extension with which browser and server negotiate, already during connection setup, which protocol they will speak afterwards, for example HTTP/2 or HTTP/3.

Alt text

A short description of an image in the HTML (the alt attribute). Screen readers read it aloud, and the browser shows it if the image does not load. Purely decorative images get an empty alt text.

AMP

Accelerated Mobile Pages

A method initiated by Google for heavily simplified, fast-loading mobile pages. Today it is no longer needed for good rankings; fast regular pages serve the same purpose.

Amplification

An amplification attack: an attacker sends small requests with a forged sender to open services, for example DNS resolvers, which send much larger answers to the victim. The victim is flooded with data.

anonymisation

Changing data so that it can no longer be linked to a person, not even with additional knowledge. Truly anonymous data no longer falls under the GDPR; merely shortened or encrypted identifiers are often only pseudonymous. This explanation does not replace legal advice.

Anycast

A method in which the same IP address is reachable at many locations. A request lands at the nearest location; large DNS services and CDNs work this way.

AP

Autoriteit Persoonsgegevens

The Dutch data protection authority. It supervises compliance with the GDPR in the Netherlands and can impose fines.

API

Application Programming Interface

A defined way for programs to exchange data with each other. For example, an online shop can pass orders to an inventory system through an API.

APNIC

Asia-Pacific Network Information Centre

The regional registry for IP addresses and AS numbers in the Asia-Pacific region, one of the five Regional Internet Registries.

APT

advanced persistent threat

A well-resourced group of attackers, often state-backed, that stays unnoticed in networks over a long period in order to steal data or disrupt systems.

ARC

Authenticated Received Chain

A method for forwarded emails: every server along the way records which checks (SPF, DKIM, DMARC) the message passed there. The recipient can then tell a forwarded message from a forged one.

ARI

ACME Renewal Information

An extension of ACME through which a certificate authority tells the client in which time window it should renew a certificate. This lets it spread renewals or trigger them earlier after a revocation.

ARIA

Accessible Rich Internet Applications

Additional attributes in HTML that tell screen readers the role, name and state of controls, for example whether a menu is open. ARIA used incorrectly can do more harm than good.

ARIN

American Registry for Internet Numbers

The regional registry for IP addresses and AS numbers in North America and parts of the Caribbean, one of the five Regional Internet Registries.

AS

autonomous system

A network that a single operator such as an internet provider, a data centre or a large company manages on its own on the internet. Every autonomous system has a number (ASN) and exchanges routes with other networks via BGP.

ASCII

American Standard Code for Information Interchange

An old character set with 128 characters: Latin letters without accents, digits and punctuation. Accented letters and other scripts need an extension such as UTF-8.

ASN

Autonomous System Number

The number of an autonomous system: a network that an operator such as an internet provider, a data centre or a large company manages on its own on the internet. The ASN shows which network an access comes from.

Assertion

A defined expectation in an automated check, for example "the response has status code 200" or "the page contains the text cart". If it does not hold, the check fails.

Attribution

Assigning a result to its cause. In web analytics this means deciding which channel or campaign a purchase or enquiry is credited to.

AV1

AOMedia Video 1

A free method for compressing videos, developed by the Alliance for Open Media (AOMedia). The image format AVIF uses the same technique for single images.

AVB

Allgemeine Versicherungsbedingungen (general insurance terms)

General insurance terms: the rules of an insurance contract, for example which damage is covered and which duties the policyholder has. "AVB Cyber" are the model terms for cyber insurance. This explanation does not replace legal advice.

AVIF

AV1 Image File Format

A modern image format that usually stores photos much smaller than JPEG at the same quality. Current browsers can display it.

AXFR

Authoritative Zone Transfer

A complete transfer of a DNS zone from one name server to another. If it is allowed for anyone, an outsider can fetch all records of a domain at once.

AZ

availability zone

A separate part of a cloud provider's data centre location with its own power and network supply. "Multi-AZ" means a service runs in several zones and survives the failure of one zone.

B2B

business-to-business

Business between companies, as opposed to business with consumers (B2C).

B2C

Business-to-Consumer

Business between a company and consumers, for example an online shop for private customers.

Backend

The part of an application that runs on the server: data, processes and administration. Visitors do not see it directly; in shops and CMS, the admin area is also called the backend.

BaFin

Bundesanstalt für Finanzdienstleistungsaufsicht (Federal Financial Supervisory Authority)

The German supervisory authority for banks, insurers and securities trading. Among other things, it checks whether financial companies secure their IT adequately.

Baseline

A recorded starting point or target state against which later measurements are compared, for example the checksums of the scripts on a page. This makes deviations stand out.

BCMS

business continuity management system

A structured approach that keeps an organization's important processes running in an emergency, or restarts them quickly: responsibilities, emergency plans, drills and regular review. BSI Standard 200-4 describes how to build such a system.

BCP

Best Current Practice

A series of RFC documents with recommendations for operating the internet that have proven themselves in practice. A BCP has its own number that points to one or more RFCs.

BEAST

Browser Exploit Against SSL/TLS

A well-known attack from 2011 on old versions of SSL and TLS (up to TLS 1.0). It shows why servers should no longer offer these old versions.

BEC

Business Email Compromise

Fraud using forged or hijacked business emails: attackers pose, for example, as management or a supplier and request a transfer to an outside account.

BfDI

Bundesbeauftragte für den Datenschutz und die Informationsfreiheit (German Federal Commissioner for Data Protection and Freedom of Information)

The German federal authority for data protection. It supervises data protection at federal public bodies and at telecommunications and postal companies, and represents Germany on the European Data Protection Board.

BFSG

Barrierefreiheitsstärkungsgesetz (German Accessibility Strengthening Act)

German law that implements the European Accessibility Act. It can apply to online shops and other digital services for consumers, which then have to be usable without barriers. This explanation does not replace legal advice.

BGB

Bürgerliches Gesetzbuch (German Civil Code)

The central code of German private law. Among other things, it governs contracts, sales, liability and the handling of general terms and conditions. This explanation does not replace legal advice.

BGG

Behindertengleichstellungsgesetz (Disability Equality Act)

Behindertengleichstellungsgesetz, the German Disability Equality Act: a federal law intended to prevent discrimination against people with disabilities. Among other things, it provides for a conciliation procedure. This explanation does not replace legal advice.

BGH

Bundesgerichtshof (Federal Court of Justice of Germany)

Bundesgerichtshof, the Federal Court of Justice of Germany and highest German court for civil and criminal matters. Its judgments shape how laws are interpreted in practice, for example in competition or data protection law. This explanation does not replace legal advice.

BGP

Border Gateway Protocol

The protocol with which the large networks on the internet (autonomous systems) tell each other which IP address ranges they can reach. This creates the routes along which data travels from network to network.

BI

Business Intelligence

Analysing company data with tools for reports, charts and dashboards in order to base decisions on figures.

BIMI

Brand Indicators for Message Identification

A method with which supporting email programs show a brand's logo next to its emails. It requires a strictly configured DMARC policy and often also a brand certificate.

BIND

Berkeley Internet Name Domain

Widely used free software for DNS servers, developed by the Internet Systems Consortium (ISC). It can serve the records of its own zones and, as a resolver, look up names for other computers.

BITV

Barrierefreie-Informationstechnik-Verordnung (German Accessible Information Technology Ordinance)

A German regulation that specifies how accessible the websites and apps of federal public bodies must be. It refers to the European standard EN 301 549 and thus to the WCAG. This explanation does not replace legal advice.

Blocklist

A list of addresses, domains or servers known as sources of spam or attacks. Emails from servers on such a list are often rejected. It used to be called a blacklist as well.

BMF

Bundesministerium der Finanzen (Federal Ministry of Finance)

The German Federal Ministry of Finance. Among other things, it publishes letters explaining how the tax authorities apply tax rules, for example on keeping records.

Bogon

An IP address that should not appear on the public internet, for example from private or reserved ranges. Packets with such senders are usually forged or misrouted.

BOM

Byte Order Mark

An invisible character sequence at the start of a text file that indicates the encoding. It can cause problems, for example when it is output before the first header of a web page.

Bot

A program that opens web pages or performs tasks automatically, for example search engine crawlers, monitoring services or attackers.

Bounce rate

The share of visits in which someone views only one page and leaves the website without any further action.

brute force

An attack by sheer trial and error: a program tries very many passwords or keys one after another until one fits. Long passwords and limited login attempts make it hopeless.

BSI

Bundesamt für Sicherheit in der Informationstechnik

Germany's Federal Office for Information Security. It warns about security vulnerabilities and publishes recommendations and standards, for example IT-Grundschutz (IT baseline protection).

BSIG

BSI-Gesetz (German act on the Federal Office for Information Security)

The German law on the Federal Office for Information Security (BSI). It governs the office's tasks and, since the implementation of the NIS2 directive, also the security obligations of many companies. This explanation does not replace legal advice.

Burn rate

The speed at which an error budget is used up. A burn rate of 1 uses it up exactly over the intended period, higher values correspondingly faster; alerts often only fire at a high burn rate.

CA

Certificate Authority

A certificate authority: an organisation that issues SSL/TLS certificates after checking that the applicant controls the domain. Browsers only trust certificates from recognised certificate authorities.

CAA

Certification Authority Authorization

A DNS record in which the domain owner specifies which certificate authorities may issue certificates for the domain. Other authorities have to refuse the request.

Cache

Temporary storage that keeps frequently requested data ready so it is available faster next time. An outdated cache can delay changes from becoming visible.

Pronunciation: like "cash"

Cache-Control

An HTTP header that specifies whether and for how long browsers and caches may keep a response.

Canonical

A setting in the head of a page that states which address is the main version when the same content can be reached under several addresses. Search engines should then count that address.

CAPTCHA

Completely Automated Public Turing test to tell Computers and Humans Apart

A test meant to tell people apart from automated programs, for example with distorted characters or picture tasks. Many CAPTCHAs are hard to solve for people with disabilities.

CBC

Cipher Block Chaining

An older operating mode for block encryption in which each block depends on the previous one. In TLS it was the target of several attacks; TLS 1.3 no longer permits it.

CDN

Content Delivery Network

A network of servers in many locations that caches the files of a website and delivers them from the nearest location. This can reduce loading times and take load off your own server.

CEO

chief executive officer

The chief executive of a company, in Germany usually the managing director (Geschäftsführer) or chair of the board.

Certificate chain

The sequence of certificates from the website certificate through intermediate certificates to a root certificate that the browser trusts. If a link is missing, some browsers report an error.

Certificate lifetime

The period during which a certificate is valid. After that, browsers show a warning. The permitted lifetime of public certificates is getting shorter step by step, which is why automatic renewal is worthwhile.

Certificate Transparency

Public logs in which certificate authorities record issued certificates and which can only be added to, not changed afterwards. This lets every domain owner see which certificates have been issued for their domain.

CEST

Central European Summer Time

Central European Summer Time: two hours ahead of Coordinated Universal Time (UTC+2). In winter, Central European Time (UTC+1) applies.

Changelog

A list of changes to a piece of software or a website, usually ordered by date or version.

Checkout

The till of an online shop: the steps from the shopping cart through address and payment method to the submitted order.

CI/CD

Continuous Integration and Continuous Delivery

An automated pipeline in software development: every change is built and tested straight away (continuous integration) and then shipped without manual work (continuous delivery or deployment).

CIDR

Classless Inter-Domain Routing

A notation for a block of IP addresses, for example 192.0.2.0/24: the number after the slash states how many leading bits are fixed; the smaller it is, the larger the block.

Cipher

An encryption method. In TLS, a cipher suite is the combination of methods for key exchange, encryption and integrity checks that browser and server agree on.

CISA

Cybersecurity and Infrastructure Security Agency

The US agency for cybersecurity and the protection of critical infrastructure. It publishes alerts and a list of vulnerabilities that are known to be exploited.

CJEU

Court of Justice of the European Union

The Court of Justice of the European Union in Luxembourg. It gives the binding interpretation of how EU law such as the GDPR is to be understood; national courts follow it. This explanation does not replace legal advice.

CLI

command line interface

Operating a program through text commands in a terminal instead of windows and buttons. Many developer tools are available as a CLI.

CLM

certificate lifecycle management

Managing certificates over their whole lifetime: requesting, deploying, renewing in time and revoking when needed. The shorter certificates are valid, the more important this becomes.

Cloaking

Deceiving search engines: their crawlers are shown different content than visitors. Search engines treat this as a violation and can penalise the page.

CLOUD Act

Clarifying Lawful Overseas Use of Data Act

A US law under which US authorities can demand data from US providers even if the data is stored on servers outside the USA. That is why a data centre in Europe is not always enough on its own for data protection. This explanation does not replace legal advice.

CLS

Cumulative Layout Shift

A Core Web Vitals metric that measures how much content shifts unexpectedly while a page loads. A low value means that text and buttons stay in place.

CMC

Common Mark Certificate

A certificate for BIMI that allows a brand logo to be shown next to emails. Unlike a VMC, proof that the logo has been in public use for some time is enough; a registered trademark is not required.

CMP

Consent Management Platform

A tool for managing consent, usually visible as a cookie banner. It asks visitors which services they agree to, stores the choice and passes it on to the embedded scripts.

CMS

Content Management System

Software for creating and editing the content of a website without programming skills, for example WordPress or TYPO3.

CNA

CVE Numbering Authority

An organisation authorised to assign CVE numbers to security vulnerabilities, for example a software vendor or a security agency. This gives every vulnerability a unique identifier.

CNAME

Canonical Name

A DNS record that makes one name an alias for another name, for example www for the main domain or a subdomain for a cloud service.

CNIL

French data protection authority

The French data protection authority. Its decisions and recommendations, for example on cookies and web analytics, are also noted in other EU states.

CO2

carbon dioxide

Carbon dioxide, the most important greenhouse gas. When websites are run, it is produced indirectly through the electricity for data centres, networks and devices.

CO2e

carbon dioxide equivalent

Carbon dioxide equivalent: a measure that converts the climate effect of different greenhouse gases into the amount of carbon dioxide that would have the same effect.

CoAP

Constrained Application Protocol

A lightweight network protocol for small devices with little power and memory, such as sensors. It works much like HTTP but needs far less data.

COEP

Cross-Origin-Embedder-Policy

An HTTP header with which a page specifies that it may only load third-party content that explicitly allows this. Together with COOP, it unlocks specially protected browser features.

Consent

The explicit agreement of a visitor, for example to cookies or statistics, before the website processes the corresponding data. It should be given freely and can be withdrawn. This explanation does not replace legal advice.

Contrast ratio

A measure of the difference in brightness between text and background, from 1:1 (identical) to 21:1 (black on white). The WCAG require at least 4.5:1 for normal text and 7:1 at the highest level.

Conversion

A desired action by a visitor, for example a purchase, a sign-up or an enquiry. The conversion rate is the share of visits with such an action.

Cookie

A small text file that a website stores in the browser, for example for a login or a shopping cart. Cookies that are not technically necessary usually require consent.

Cookie banner

A notice shown on the first visit to a website, in which visitors choose which cookies and services they agree to.

Cookieless

Without cookies: a method, such as visitor statistics, that stores no cookies in the browser. Whether consent is needed depends on what other data is read or stored. This explanation does not replace legal advice.

COOP

Cross-Origin-Opener-Policy

A security header that specifies whether a window stays connected to windows of another origin that opened it or that it opened. It protects against attacks via such window relationships.

Core Web Vitals

Three metrics from Google for the user experience of a page: when the largest content has loaded (LCP), how quickly the page responds to input (INP) and how stable the layout stays (CLS).

CORP

Cross-Origin-Resource-Policy

An HTTP header with which a single file, for example an image or script, specifies which other pages may load it: only the same origin, the same site or all.

corporate identity

The uniform appearance of a company, for example logo, colours and typeface. Short form CI; not to be confused with CI in the sense of continuous integration.

CORS

Cross-Origin Resource Sharing

Rules with which a server specifies which other websites may read its responses in the browser. If CORS is set too generously, other sites can fetch data as well.

CPE

Common Platform Enumeration

A standard naming scheme for software, operating systems and devices including their version. Vulnerability databases use it to match vulnerabilities to a product.

CPU

Central Processing Unit

Processor: the computing core of a computer or server. Constantly high CPU usage makes responses slower.

CR

conversion rate

The share of visitors who carry out a desired action, for example buying or submitting a form. A CR of 2% means 2 out of 100 visitors do it.

CRA

Cyber Resilience Act

An EU regulation on cybersecurity for products with digital elements, that is hardware and software. It requires manufacturers, for example, to provide security updates and to handle reported vulnerabilities. This explanation does not replace legal advice.

Crawler

A program that opens web pages automatically and follows links to record them, for example for a search engine or to check all pages.

CRL

Certificate Revocation List

A list published by a certificate authority that contains all certificates it has declared invalid early.

CRM

Customer Relationship Management

Managing customer relationships and the software for it: contacts, enquiries, quotes and sales in one place.

Cron

A schedule on a server by which tasks run on their own at regular times, for example a backup every night. Such a task is called a cron job.

CRS

Core Rule Set

A free collection of rules for web application firewalls, maintained by the OWASP project. It detects typical attacks but sometimes also flags harmless requests such as monitoring checks as suspicious.

CrUX

Chrome User Experience Report

A public dataset from Google with loading times measured during real visits in Chrome (field data). It is the basis for the Core Web Vitals in Google Search.

CSAT

customer satisfaction score

A measure of customer satisfaction: customers rate a service on a short scale, and the share of satisfied answers is counted.

CSIRT

Computer Security Incident Response Team

A team that receives and assesses security incidents and helps to respond to them. In Germany, the BSI is the national CSIRT, which companies can also turn to.

CSP

Content Security Policy

A security rule that a website passes to the browser. It defines from which sources scripts, images and other content may be loaded, which makes it harder to inject foreign code.

CSPRNG

Cryptographically Secure Pseudo-Random Number Generator

A random number generator whose results cannot be predicted even with a lot of computing effort. Only such generators are suitable for passwords and keys; in the browser it is provided by crypto.getRandomValues().

CSRD

Corporate Sustainability Reporting Directive

An EU directive under which certain companies must report on sustainability, for example on their greenhouse gas emissions. Which companies are covered and from when depends on their size and type. This explanation does not replace legal advice.

CSRF

Cross-Site Request Forgery

An attack in which an outside website gets the browser of a logged-in user to perform an action on another website without them noticing. One-time tokens in forms and SameSite cookies protect against it.

CSS

Cascading Style Sheets

The language that defines how web pages look: colours, fonts, spacing and layout.

CSV

Comma-Separated Values

A simple text format for tables: each line is one record, and the values are separated by commas or semicolons. Spreadsheet programs can open CSV files.

CTA

Call to Action

A call to action: a button or link that invites the next step, for example "Try it now" or "Request a quote".

CTR

Click-Through Rate

Click-through rate: the share of people who see an entry, an ad or a link and also click it. 100 impressions and 3 clicks give 3 per cent.

CUPED

Controlled-experiment Using Pre-Experiment Data

A statistical method for A/B tests: it uses data from before the test to remove random fluctuations. This lets a test reach a reliable result with fewer visitors.

CVD

Coordinated Vulnerability Disclosure

An agreed procedure for reporting a security vulnerability: whoever finds it reports it to the operator first and only publishes it once a fix is available or an agreed time has passed.

CVE

Common Vulnerabilities and Exposures

A public directory of known security vulnerabilities. Each vulnerability gets an identifier there following the pattern CVE-year-number, which makes advisories and updates easy to match.

CVSS

Common Vulnerability Scoring System

A rating system for the severity of security vulnerabilities on a scale from 0 to 10. The higher the score, the more urgently the vulnerability should be closed.

CWE

Common Weakness Enumeration

A public list of types of weaknesses in software, for example missing input validation. A CVE describes a single flaw; the CWE assigns it to a type.

DACH

Germany, Austria, Switzerland

A collective term for the German-speaking countries Germany, Austria and Switzerland, formed from their country codes D, A and CH.

DANE

DNS-based Authentication of Named Entities

A method that uses DNS records protected by DNSSEC to specify which certificate a server must use. Mail servers can thus deliver encrypted without falling for a fake counterpart.

Dashboard

An overview page that shows important figures and states at a glance, often as tiles and charts.

Data breach

A breach of the protection of personal data, for example when customer data falls into the wrong hands or is lost. Under the GDPR it usually has to be reported to the supervisory authority and, in some cases, to the people concerned. This explanation does not replace legal advice.

DAX

Deutscher Aktienindex (German stock index)

The most important German stock index, made up of the 40 largest listed companies. MDAX and SDAX are the indices for the next smaller mid-sized and smaller companies.

DB

database

An organised data store into which a program writes data and from which it queries them again in a targeted way, for example customer accounts, measurements or histories.

DBIR

Data Breach Investigations Report

An annual report by the telecommunications group Verizon on security incidents and data breaches, often used as a source of figures on attacks.

DCV

Domain Control Validation

A check with which a certificate authority establishes, before issuing a certificate, that the applicant really controls the domain, for example via a DNS record or a file on the server.

DDG

Digitale-Dienste-Gesetz

A German law for digital services that succeeded the Telemedia Act. Among other things, it governs the obligation for websites to have a legal notice (Impressum). This explanation does not replace legal advice.

DDoS

Distributed Denial of Service

An attack in which a great many computers flood a service with requests at the same time until it can no longer be reached.

Defacement

An unauthorised change to the visible content of a website, for example injected text, images or redirects after an attack.

DENIC

DENIC eG, formerly Deutsches Network Information Center

A cooperative that, as the registry, manages domains ending in .de and runs the lookup service for their holder data.

Deployment

Rolling out a new version of a website or software to the server it runs on. Deploy is the short form.

DKIM

DomainKeys Identified Mail

A method in which outgoing emails carry a digital signature. The recipient checks it with a key published in DNS and can tell whether the message was changed on the way.

DMARC

Domain-based Message Authentication, Reporting and Conformance

A rule in DNS that tells recipients how to handle emails that fail the SPF or DKIM check and where to send reports about them.

DNS

Domain Name System

The directory of the internet that translates names such as www.example.com into the addresses of the responsible servers. It also holds records for email and security.

DNS hijacking

An attack in which DNS records or name resolution are redirected so that visitors end up on someone else's server, for example after the account at the registrar has been taken over.

DNS record

A single entry in the DNS of a domain, for example an A record with the IP address of the server, an MX record for email or a TXT record with text.

DNS64

A method for IPv6-only networks: for a destination that only has an IPv4 address, the resolver creates a matching IPv6 address. Together with NAT64 the devices can then also reach IPv4-only services.

DNSBL

DNS-based Blocklist

A blocklist of IP addresses or domains that have been noticed as sources of spam, which can be queried via DNS. Mail servers often reject emails from listed senders.

DNSKEY

DNS Public Key

A DNS record with the public key of a zone. With it, resolvers check under DNSSEC whether the zone's answers are genuine and unchanged.

DNSSEC

Domain Name System Security Extensions

An extension of DNS in which records are digitally signed. This makes it possible to check that a DNS answer is genuine and was not forged on the way.

DO bit

DNSSEC OK bit

A flag in a DNS query with which a resolver says that it understands DNSSEC. The name server then sends the signatures along so that the answer can be verified.

DoH

DNS over HTTPS

A method of sending DNS queries encrypted over HTTPS. Third parties on the network then cannot see which names are being looked up.

DOM

Document Object Model

The tree of all parts of a loaded page in the browser, such as headings, paragraphs, images and buttons. Scripts read and change the page through this tree.

Domain

The name of a website on the internet, for example example.com. DNS translates the name into the address of the server.

DORA

Two different meanings: the Digital Operational Resilience Act, an EU regulation on the digital resilience of banks, insurers and their IT service providers, and DevOps Research and Assessment, a research group that publishes the annual "State of DevOps" report. Which one is meant follows from the context.

DoS

denial of service

An attack that takes a service down by overloading it, so that real visitors can no longer reach it. If the attack comes from many machines at once, it is called DDoS.

DoT

DNS over TLS

DNS queries sent encrypted over TLS, so that third parties on the network cannot see which addresses someone looks up. A related technique is DoH (DNS over HTTPS).

Downtime

The period in which a website or service cannot be reached or does not work properly.

DPA

Data Processing Agreement

A contract with a service provider that processes personal data on your behalf, for example for hosting or visitor statistics. It sets out how the provider must handle the data; under the GDPR it is then usually required. This explanation does not replace legal advice.

DPF

EU-U.S. Data Privacy Framework

An agreement between the EU and the USA for the transfer of personal data. US companies that certify under it are regarded as recipients with an adequate level of data protection. This explanation does not replace legal advice.

DPIA

Data Protection Impact Assessment

A prior assessment under the GDPR of the risks a planned data processing operation poses for the people concerned and how they can be reduced. It is required for processing likely to involve a high risk. This explanation does not replace legal advice.

DPO

Data Protection Officer

A person who advises a company on data protection and monitors compliance with the rules; in German Datenschutzbeauftragte or Datenschutzbeauftragter. Whether a company must appoint such a person depends, among other things, on its size and the type of data processing. This explanation does not replace legal advice.

DS

Delegation Signer

A record in the parent zone that confirms the key of a zone, for example in .de for example.de. This creates a continuous chain of trust under DNSSEC.

DSA

Digital Services Act

The EU regulation on digital services. Among other things, it governs how platforms and hosting providers handle notices about illegal content. This explanation does not replace legal advice.

DSB

Datenschutzbehörde (Austrian data protection authority)

The Austrian data protection authority: the state supervisory body for data protection in Austria. Its decisions, for example on web analytics tools, are also noted in other EU states. This explanation does not replace legal advice.

DSK

Datenschutzkonferenz

Datenschutzkonferenz, the conference of the independent German data protection authorities at federal and state level. It publishes joint resolutions and guidance, for example on cookies and web analytics. This explanation does not replace legal advice.

DSL

Digital Subscriber Line

Internet access over the existing copper telephone line. It is widespread but usually slower than fibre or cable.

DST

Daylight Saving Time

Daylight saving time: clocks go forward one hour in spring and back in autumn. Time-of-day reports have one hour too many or too few on these days.

dual stack

Running IPv4 and IPv6 at the same time: a service can be reached under both kinds of address, and each device uses the one it supports.

DV

domain validation

The simplest kind of TLS certificate: the certificate authority only checks that the applicant controls the domain, not who is behind it. Let's Encrypt issues such certificates.

E2E

end-to-end

Tests that run through an application from start to finish the way a user would, for example signing in, ordering and paying in the browser.

EAA

European Accessibility Act

An EU directive that requires accessibility for many products and services, including online shops and banking services. In Germany it has been implemented through the Accessibility Strengthening Act (BFSG). This explanation does not replace legal advice.

EAN

European Article Number

An older name for the item number in the barcode of a product. Today it is called GTIN; the 13-digit form is the GTIN-13.

EBA

European Banking Authority

The European Banking Authority. It is one of the three European supervisory authorities (ESAs) and, among other things, drafts the rules on digital operational resilience (DORA).

ECB

European Central Bank

The European Central Bank: the central bank of the countries using the euro. Among other things, it publishes daily reference exchange rates.

ECC

elliptic curve cryptography

Encryption based on elliptic curves. It achieves the same security as RSA with much shorter keys and is therefore faster.

ECDHE

Elliptic Curve Diffie-Hellman Ephemeral

A method with which browser and server negotiate a new secret key for each connection. If the server key becomes known later, earlier connections still remain protected.

ECDSA

Elliptic Curve Digital Signature Algorithm

A method for digital signatures based on elliptic curves. With much shorter keys, it offers security similar to RSA and is often used for SSL certificates and DNSSEC.

ECH

Encrypted Client Hello

A TLS extension that also encrypts the name of the website being visited. Without ECH, an eavesdropper on the network can see this name during connection setup.

EDPB

European Data Protection Board

The European Data Protection Board: the body of the data protection authorities of the EU member states. It publishes guidelines on how the GDPR is to be interpreted.

EDPS

European Data Protection Supervisor

The European Data Protection Supervisor: an independent authority that supervises data protection at the EU institutions and bodies and gives opinions on new EU rules.

EEA

European Economic Area

The economic area made up of the EU member states plus Iceland, Liechtenstein and Norway. The GDPR also applies there; transfers within the EEA are therefore not considered transfers to a third country.

EGBGB

Einführungsgesetz zum Bürgerlichen Gesetzbuche (Introductory Act to the German Civil Code)

A companion law to the German Civil Code (BGB). Among other things, it sets out in detail which information a trader has to give consumers before a contract in online retail. This explanation does not replace legal advice.

EIOPA

European Insurance and Occupational Pensions Authority

The European Insurance and Occupational Pensions Authority, one of the three European supervisory authorities (ESAs).

ELSTER

Elektronische Steuererklärung (electronic tax return)

The German tax administration's online system for tax returns. The associated company account (MUK) is also used to sign in to other government portals, for example at the BSI.

EN 301 549

European Standard 301 549

A European standard with accessibility requirements for IT products and services; for websites, it refers to the WCAG. The abbreviation EN stands in front of every European standard, for example also EN 16931 for electronic invoices.

Endpoint

A specific address of an API or server to which a program sends requests, for example /api/status.

ENISA

European Union Agency for Cybersecurity

The European Union agency for cybersecurity. It advises the EU member states, publishes threat reports and runs the European vulnerability database EUVD.

EoL

end of life

The point from which a vendor no longer supplies updates for software or a device. After that, new security vulnerabilities remain open.

EPP

Extensible Provisioning Protocol

The standard protocol through which registrars create, change and transfer domains at the registry. The status codes of a domain, such as a transfer lock, also come from it.

ERP

Enterprise Resource Planning

Software with which a company manages inventory, purchasing, accounting and orders in one place. Shops are often connected to it.

Error budget

The allowed downtime that follows from an SLO: at 99.9% per month this is about 43 minutes. Once the budget is used up, stability takes priority over new changes.

ES module

ECMAScript module

The built-in way to split JavaScript code into files and connect them with "import" and "export". Modern browsers load such modules directly.

ESA

European Supervisory Authorities

The three European supervisory authorities for the financial market: EBA for banks, ESMA for securities and EIOPA for insurance. Together they draft, for example, the technical rules for DORA.

ESMA

European Securities and Markets Authority

The European Securities and Markets Authority, one of the three European supervisory authorities (ESAs).

ESP

email service provider

A service provider that companies use to send emails, above all newsletters and automated messages. It runs the mail servers and takes care of delivery and reporting.

ESRS

European Sustainability Reporting Standards

European standards that set out what companies report on sustainability under the CSRD and how. ESRS E1, for example, covers climate change. This explanation does not replace legal advice.

ETag

Entity Tag

An identifier that the server sends for a particular version of a file. If the browser later asks with it, the server only replies "not modified" as long as the file is unchanged.

EU

European Union

A union of European states with common rules, for example on data protection (GDPR) or accessibility.

EUIPO

European Union Intellectual Property Office

The European Union's intellectual property office in Alicante. It registers trade marks and designs that apply throughout the EU, such as EU trade marks.

EUR

euro

The code for the euro currency under the international standard for currency codes, just as USD stands for the US dollar.

EUVD

European Vulnerability Database

A European database of known security vulnerabilities, run by the EU Agency for Cybersecurity (ENISA). It complements directories such as the CVE list.

EV

Extended Validation

The highest validation level for SSL certificates: besides the domain, the certificate authority also checks the legal existence of the company. Browsers hardly show this separately any more.

Exploit

Code or a method that takes advantage of a security vulnerability, for example to break into a system; to exploit a vulnerability means to use it in this way. If a ready-made exploit already exists for a vulnerability, it is especially urgent to close it.

FAGG

Fern- und Auswärtsgeschäfte-Gesetz (Austrian Distance and Off-Premises Contracts Act)

Fern- und Auswärtsgeschäfte-Gesetz, the Austrian law on distance and off-premises contracts, for example contracts concluded online or by phone. It covers, among other things, the right of withdrawal. This explanation does not replace legal advice.

Fallback

A backup solution that steps in when the intended way does not work, for example a substitute font when the web font does not load.

FAQ

Frequently Asked Questions

A collection of questions and answers on a topic that come up often.

FBI

Federal Bureau of Investigation

The federal police of the USA. It also investigates internet crime and collects reports of online fraud through its complaint centre IC3.

FCP

First Contentful Paint

A loading metric: the moment at which the browser draws the first content of a page, for example text or an image. It shows when visitors first see something.

FCrDNS

Forward-Confirmed reverse DNS

A cross-check between IP address and name: the reverse record of the address names a host name, and this name points back to the same address. Mail servers and bot detection check this because it is hard to fake.

FHD

Full High Definition

A screen resolution of 1920 × 1080 pixels, also called Full HD. It is widespread on desktop screens.

FID

First Input Delay

A former Core Web Vitals metric: the delay until the response to a visitor's first input. It was replaced in 2024 by INP, which takes all inputs into account.

FIDO

Fast IDentity Online

An association of companies that develops open standards for signing in without a password, such as passkeys and security keys. These methods are considered resistant to phishing.

Fingerprinting

Recognising a browser or device without a cookie, from many characteristics such as screen size, fonts and settings. For data protection it is treated much like cookies; consent is often required. This explanation does not replace legal advice.

FIPS

Federal Information Processing Standards

Standards of the US federal agency NIST for information technology, especially for encryption. FIPS 203, for example, specifies the ML-KEM scheme.

Firewall

A protective system that lets network traffic through or blocks it according to defined rules, for example between the internet and a server.

First-party

Coming from the website operator itself, for example cookies, scripts or data from its own domain. The counterpart is third-party, meaning content from outside providers.

Flapping

A check result switching constantly between up and down in quick succession. Without damping, flapping produces many alerts that are not caused by a real outage.

FOUT

flash of unstyled text

A short moment while a page loads in which text first appears in a fallback font and then switches to the web font. If the two fonts have different metrics, the layout shifts.

Framework

A ready-made set of building blocks and rules on which developers build software or a website instead of writing everything themselves.

FREAK

Factoring RSA Export Keys

An attack from 2015 that forces a connection down to old, deliberately weak "export" encryption. The remedy is to switch such methods off on the server.

Frontend

The part of a website or application that visitors see and use in the browser.

FTP

File Transfer Protocol

An old protocol for transferring files between a computer and a server. It sends the password and data unencrypted; SFTP or FTPS are more secure.

FTPS

FTP Secure

FTP with encryption via TLS: files are transferred as with FTP, but the password and data are encrypted. SFTP is a different method that works over SSH.

Funnel

A sequence of steps towards a goal, for example product page, cart, checkout and purchase. The analysis shows at which step visitors drop off.

GB

gigabyte

Gigabyte: a unit for amounts of data, one billion bytes or 1,000 megabytes. Some programs count 1,073,741,824 bytes instead.

GBP

pound sterling

The code for the British pound sterling under the international standard for currency codes, just as EUR stands for the euro.

GCM

Galois/Counter Mode

An operating mode for block encryption that encrypts data and checks its integrity at the same time. In the form AES-GCM it is the usual standard in TLS today.

GDPR

General Data Protection Regulation

EU regulation on the protection of personal data. Among other things, it governs when a website may collect and analyse data about its visitors. This explanation does not replace legal advice.

GDV

Gesamtverband der Deutschen Versicherungswirtschaft (German Insurance Association)

The umbrella association of insurance companies in Germany. It publishes statistics and non-binding model terms, for example for cyber insurance.

GEO

Generative Engine Optimization

Optimising content so that AI search services and chat assistants find it, understand it and cite it as a source. The counterpart of SEO for classic search engines.

GIF

Graphics Interchange Format

An old image format with at most 256 colours that can also contain short animations. For photos and animations, WebP or video formats are usually smaller.

GMT

Greenwich Mean Time

The time at the prime meridian in Greenwich. In HTTP headers and certificate details, GMT stands for Coordinated Universal Time (UTC), without daylight saving time.

GoBD

Grundsätze zur ordnungsmäßigen Führung und Aufbewahrung von Büchern, Aufzeichnungen und Unterlagen in elektronischer Form sowie zum Datenzugriff (German principles for electronic bookkeeping)

Rules of the German tax administration on how companies keep and store accounting and tax-relevant records electronically. This explanation does not replace legal advice.

GPU

graphics processing unit

A graphics processor: a chip that performs very many simple calculations at the same time. Attackers use this to try passwords in bulk; slow methods such as bcrypt hold this back.

GSM

Global System for Mobile Communications

The second-generation mobile network standard for calls and text messages. The association GSMA bears its name.

GSMA

GSM Association

The worldwide association of mobile network operators. Among other things, it publishes figures on how people use the mobile internet.

GTIN

Global Trade Item Number

A worldwide unique item number for a product, as shown in its barcode. GTIN-13 is the 13-digit form, formerly called EAN. Search engines use it to identify products.

GUI

graphical user interface

A user interface with windows, buttons and menus that is operated with a mouse, finger or keyboard. The counterpart is the command line (CLI).

H1–H6

headings of levels 1 to 6

The six heading levels of a web page in HTML: H1 is the main heading, H2 to H6 structure the content below it in ever finer steps. Search engines and screen readers read the structure of the page from this order; a skipped level (for example from H2 straight to H4) makes orientation harder.

Handshake

Setting up a connection, in which two computers agree on terms before the actual data exchange, for example in the TLS handshake on encryption and certificate.

Hash

A checksum: a short string calculated from data. Even the smallest change to the data produces a completely different hash, so changes stand out.

HD

High Definition

A screen resolution of 1280 × 720 pixels. Higher levels are Full HD, WQHD and UHD.

HDE

Handelsverband Deutschland (German Retail Federation)

The umbrella association of the retail trade in Germany. Among other things, it publishes figures and forecasts on sales in retail and online retail.

Header

Header lines of an HTTP request or response: extra information that browser and server send along, for example about the content type, caching or security rules. Emails have such header lines too.

Headless

Without its own visible interface. A headless CMS or shop delivers content only through an API, and a separate frontend handles the display. A headless browser loads pages without a window, for example for automated tests.

Heartbeat

A regular sign of life that a program or cron job sends to a monitoring service. If it stops arriving, this is reported as a problem.

Heatmap

A coloured view that shows where visitors click, tap or scroll to most often on a page; frequent spots appear in warmer colours.

HGB

Handelsgesetzbuch (German Commercial Code)

The German code for merchants and commercial companies. Among other things, it governs the commercial register, bookkeeping and how long business records have to be kept. This explanation does not replace legal advice.

HMAC

Hash-based Message Authentication Code

A check value calculated from a message and a secret key. Anyone who knows the key can use it to check that a message, for example a webhook, is genuine and unchanged.

Hosting

Providing storage space and computing power so that a website can be reached on the internet. The provider is called a host or hosting provider.

Hostname

The name of a single computer or service on a network, for example www.example.com or mail.example.com. It often consists of a subdomain and the domain.

HR

human resources

Human resources: the part of a company that deals with staff, from hiring to training and leaving. In information security, HR measures cover, for example, security checks and training of employees.

HRA

Handelsregister Abteilung A (German commercial register, section A)

Section A of the German commercial register, in which sole traders and partnerships such as OHG and KG are registered. Corporations such as the GmbH are listed in section B (HRB).

HRB

Handelsregister Abteilung B (German commercial register, section B)

Section B of the German commercial register, in which corporations such as GmbH and AG are entered. The register number with HRB belongs in the legal notice. This explanation does not replace legal advice.

HSTS

HTTP Strict Transport Security

An instruction from a website to the browser to open it only over encrypted HTTPS for a set period of time.

HTML

Hypertext Markup Language

The markup language in which web pages are written. It defines what is a heading, a paragraph, an image or a link.

HTTP

Hypertext Transfer Protocol

The protocol that browsers and servers use to exchange web pages. Without encryption, third parties can read the transferred data.

HttpOnly

A cookie flag that forbids scripts in the browser from accessing the cookie. An injected script then cannot read such a session cookie.

HTTPS

Hypertext Transfer Protocol Secure

The encrypted form of HTTP. The connection is secured with TLS, which the browser indicates in the address bar.

IAB

Interactive Advertising Bureau

An association of the online advertising industry that publishes technical standards for digital advertising, for example the TCF framework for consent.

IANA

Internet Assigned Numbers Authority

The body that manages central identifiers of the internet, for example the root zone of the DNS, the allocation of IP address ranges to the regional registries and the list of port numbers.

IBAN

International Bank Account Number

An international account number that uniquely identifies a bank account. German IBANs start with DE and have 22 characters.

IC3

Internet Crime Complaint Center

The FBI's complaint centre for internet crime. From the reports it receives, it publishes an annual report on case numbers and losses, for example from email fraud.

ICANN

Internet Corporation for Assigned Names and Numbers

A non-profit organisation that coordinates the allocation of domain names and IP addresses worldwide. Among other things, it concludes the contracts with registrars for endings such as .com.

ICMP

Internet Control Message Protocol

A helper protocol for error and status messages in the network. Ping and traceroute use it to check whether a computer can be reached and by which route.

ICO

Information Commissioner's Office

The data protection authority of the United Kingdom. It supervises data protection there and can impose fines.

ICT

Information and Communication Technology

An umbrella term for information and communication technology, meaning computers, networks, software and telecommunications. EU rules such as DORA speak of ICT risks.

ID

identifier

A label that identifies something uniquely, for example a data record, an account or an element on a page.

IEA

International Energy Agency

An intergovernmental organisation that publishes data and reports on energy use and energy markets, including the electricity demand of data centres.

IEC

International Electrotechnical Commission

An international standards organisation for electrical engineering. Many IT security standards are published jointly with ISO, for example ISO/IEC 27001.

IETF

Internet Engineering Task Force

The body that develops technical standards of the internet, for example for HTTP, DNS and email, and publishes them as RFCs.

IHK

Industrie- und Handelskammer (German Chamber of Commerce and Industry)

Industrie- und Handelskammer, a regional chamber representing commercial businesses in Germany. It advises, for example, on law and setting up a business and holds examinations.

IIS

Internet Information Services

Microsoft's web server for Windows Server. Like nginx or Apache it serves websites; settings such as security headers are configured there separately.

IMAP

Internet Message Access Protocol

The protocol an email program uses to read and manage messages on the mail server. The messages stay on the server, so every device shows the same state.

IMF

Internet Message Format

The standard for the structure of an email, that is headers and body. Its date format ("IMF-fixdate", for example "Sun, 06 Nov 1994 08:49:37 GMT") is also used in HTTP headers.

Impressum

The legal notice that German law requires on many websites: details of the provider such as name, address and contact. It should be easy to find and always available. This explanation does not replace legal advice.

Incident

A disruption or security event, for example a website outage or an attack. An incident is recorded, handled and closed once it has been resolved.

INP

Interaction to Next Paint

A Core Web Vitals metric that measures how quickly a page visibly responds to clicks, taps and key presses.

IOCTA

Internet Organised Crime Threat Assessment

Europol's annual report on crime on the internet, for example fraud, data theft and the misuse of domains.

IoT

Internet of Things

Devices connected to the internet without being classic computers, for example cameras, routers, thermostats or sensors. Poorly protected devices are often misused for attacks.

IP

Internet Protocol

The basic rule by which data on the internet is addressed and passed on. Every device on the network has an IP address, similar to a house number.

IPv4

Internet Protocol version 4

The older and still most widely used version of the Internet Protocol. Its addresses consist of four numbers, for example 192.0.2.1, and have become scarce.

IPv6

Internet Protocol version 6

The newer version of the Internet Protocol with much longer addresses, for example 2001:db8::1. It offers far more addresses than IPv4 and today usually runs alongside IPv4.

ISO

International Organization for Standardization

The International Organization for Standardization. It publishes standards that apply worldwide, for example ISO 27001 for information security or ISO 8601 for writing dates and times.

ISP

Internet Service Provider

An internet provider: a company that gives households and businesses access to the internet.

IT

information technology

An umbrella term for computers, networks and software and the work with them.

ITIC

Information Technology Intelligence Consulting

A consulting and market research company from the USA. Among other things, it publishes surveys on what one hour of server and application downtime costs companies.

ITP

Intelligent Tracking Prevention

A protection feature in the Safari browser that restricts tracking across websites, for example through shorter lifetimes for cookies set by JavaScript.

IXFR

Incremental Zone Transfer

A zone transfer in which a name server only sends the changes since a given version instead of the whole zone. This saves data compared with the full AXFR transfer.

JDK

Java Development Kit

The development kit for the Java programming language, with compiler, runtime environment and tools. The number after it gives the version, for example JDK 21.

JIT

just-in-time

Translating program code into machine code only while it runs. Frequently used parts then run faster; PHP, for example, offers this in addition to OPcache.

Jitter

The variation in delay between consecutive packets. For retries, a small random waiting time is also called jitter, so that not all clients ask again at the same moment.

JPEG

Joint Photographic Experts Group

A widely used image format for photos. It saves space by summarising image information with some loss; the files usually end in .jpg.

JRC

Joint Research Centre

The European Commission's Joint Research Centre: it carries out research and advises EU policy with scientific data, including on internet security.

JS

JavaScript

JavaScript: a programming language that runs in the browser and makes web pages interactive, for example menus, forms or content loaded later.

JSON

JavaScript Object Notation

A simple text format for structured data that programs can easily read and write. APIs often exchange their data as JSON.

JSON-LD

JSON for Linking Data

A way of writing structured data in JSON format that sits in a script area of the page. Search engines read from it, for example, who offers the page or which questions it answers.

JSONL

JSON Lines

A text format in which each line is a separate JSON object. It suits large amounts of data because it can be read and appended line by line.

JSONP

JSON with Padding

An old technique with which a page loads data from another domain as a script to get around a browser security boundary. Because this runs foreign code, it is now considered a risk; CORS has taken its place.

JWE

JSON Web Encryption

An encrypted token in JSON format: the content can only be read with the matching key. A decoder without that key cannot display it.

JWS

JSON Web Signature

A signed token in JSON format: the content is readable but protected against changes by a signature. Most JWTs are JWS.

JWT

JSON Web Token

A compact, signed token in JSON format that carries details such as the user and expiry time. Servers use it to check a login without looking it up in the database each time.

KB

kilobyte

Kilobyte: a unit for amounts of data, one thousand bytes. Some programs count 1,024 bytes instead.

KEV

Known Exploited Vulnerabilities

A list kept by the US agency CISA of vulnerabilities that are known to be exploited by attackers already. Anyone who has to prioritise usually starts with these.

KG

Kommanditgesellschaft (German limited partnership)

A German partnership in which at least one partner has unlimited liability and the others are liable only up to their contribution. It is listed in section A of the commercial register (HRA). This explanation does not replace legal advice.

KiB

kibibyte

A unit of data size: 1 KiB is exactly 1,024 bytes. A kilobyte (kB), by contrast, is 1,000 bytes.

KPI

Key Performance Indicator

A key figure by which the success of a goal can be measured, for example conversion rate, availability or loading time.

KSK

Key Signing Key

The key in DNSSEC that signs the list of keys of a zone. The KSK of the root zone is the starting point that resolvers trust when validating.

L3

Layer 3 (network layer)

Layers in the OSI model, which divides network communication into seven levels: L3 is the network layer with IP addresses, L4 the transport layer with TCP and UDP, L7 the application layer, for example HTTP. Attacks are often named after the layer they target.

LACNIC

Latin America and Caribbean Network Information Centre

The regional registry for IP addresses and AS numbers in Latin America and parts of the Caribbean, one of the five Regional Internet Registries.

LAN

local area network

A local network, for example in an office or at home: computers, printers and other devices connected directly to each other via a router or switch.

Landmark

An area of a page with a fixed role, for example header, navigation, main content or footer. Screen readers can jump directly from one landmark to the next.

lazy loading

Loading on demand: images and other content further down the page are only loaded when the visitor scrolls near them. This speeds up the initial page load.

LCP

Largest Contentful Paint

A Core Web Vitals metric that measures when the largest visible element of a page has finished loading, often an image or a heading.

LDA

Landesamt für Datenschutzaufsicht (Bavarian data protection authority)

Short name of two German authorities that supervise data protection at companies and associations: in Bavaria the Landesamt für Datenschutzaufsicht (BayLDA), in Brandenburg the Landesbeauftragte für den Datenschutz und für das Recht auf Akteneinsicht (LDA Brandenburg). In most other German states the authority is called Landesbeauftragte or Landesbeauftragter für den Datenschutz (LfD).

Legal basis

The rule that permits the processing of personal data, for example consent, a contract or a legitimate interest under the GDPR. This explanation does not replace legal advice.

Legitimate interest

One of the legal bases of the GDPR: personal data may be processed without consent if the controller's interest outweighs the interests of the people concerned. This has to be weighed up case by case. This explanation does not replace legal advice.

Let's Encrypt

A non-profit certificate authority that issues free SSL/TLS certificates with a short lifetime. The certificates are requested and renewed automatically via ACME.

LfD

Landesbeauftragte für den Datenschutz (state data protection commissioner)

Landesbeauftragte(r) für den Datenschutz, the data protection commissioner of a German federal state: the supervisory authority that checks whether data protection law is complied with, for example the LfD Niedersachsen.

LG

Landgericht

Landgericht, a German regional court at the level above the local court. Judgments of a regional court, for example the LG München I on Google Fonts, initially apply only to the case decided, but are often cited as guidance. This explanation does not replace legal advice.

LIR

Local Internet Registry

An organisation, usually a provider, that receives IP addresses from a regional registry such as RIPE NCC and passes them on to its customers.

LLM

Large Language Model

A large language model: an AI program that has learned from very large amounts of text to understand and produce language. Chat assistants and AI answers in search engines are based on it.

llms.txt

A proposed text file in the root directory of a website that gives AI language models an overview of the most important content. It is not a binding standard.

LTS

Long Term Support

A version of software that the vendor supplies with security updates over a longer period. For servers it is usually the safe choice.

Magecart

A collective name for attacks on online shops in which malicious code is injected into the pages, reads payment details in the checkout and sends them to the attackers.

Maintenance mode

A state in which a website is deliberately unavailable or only partly available because of work on it, and usually shows a notice. In monitoring, such periods can be entered as maintenance so that they do not trigger an alert.

Malware

Malicious software: programs that cause damage or steal data, for example viruses, trojans or ransomware. On websites it often appears as injected code.

Markup

Code that gives text structure and meaning, for example HTML tags for heading and paragraph. Structured data is often called markup as well.

MB

megabyte

Megabyte: a unit for amounts of data, one million bytes. Some programs count 1,048,576 bytes instead.

MD5

Message-Digest Algorithm 5

An old hash method that calculates a short fingerprint from data. It is considered broken and is unsuitable for security purposes; it still appears as a simple checksum.

MDE

Minimum Detectable Effect

The smallest difference that an A/B test can still reliably detect with a given number of visitors. The smaller it is meant to be, the more visitors the test needs.

MDL

Masked Domain List

A list of domains for which Chrome with IP Protection routes requests through proxy servers, so that these services do not see the visitor's real IP address. It mainly contains services that can track visitors across sites.

MDN

MDN Web Docs, formerly Mozilla Developer Network

Free documentation for web development with reference pages on HTML, CSS, JavaScript and HTTP. It is maintained by Mozilla and often cited as a source for browser behaviour.

Median

The middle value when all measurements are sorted by size: half are above it and half below. Single outliers hardly move it, unlike the average.

MFA

Multi-Factor Authentication

Logging in with at least two independent proofs, for example a password and a code from an app. A stolen password alone is then not enough.

MiCAR

Markets in Crypto-Assets Regulation

The Markets in Crypto-Assets Regulation, the EU regulation on markets in crypto-assets. Among other things, it governs which crypto-asset service providers need an authorisation. This explanation does not replace legal advice.

MIDI

Musical Instrument Digital Interface

A standard through which electronic musical instruments and computers exchange notes and control commands. Browsers can access such devices via Web MIDI; the Permissions-Policy can block this.

MIME

Multipurpose Internet Mail Extensions

A label for the kind of a file, for example text/html or image/png. Servers send it in the Content-Type so that the browser knows how to handle the content.

Mixed Content

An encrypted HTTPS page loads individual parts such as images or scripts unencrypted over HTTP. Browsers block such content or warn about it.

ML

Machine Learning

Machine learning: methods in which a program learns patterns from example data instead of every rule being set by hand.

ML-DSA

Module-Lattice-Based Digital Signature Algorithm

A signature method intended to be secure against quantum computers as well, based on mathematical lattices. The US standards institute NIST specified it in 2024 as FIPS 204.

ML-KEM

Module-Lattice-Based Key-Encapsulation Mechanism

A key exchange method designed to remain secure against attacks with quantum computers. The US standards institute NIST published it in 2024 as FIPS 203; browsers use it in TLS together with a classical method.

Monitoring

Continuous, automatic supervision of a website or service. If something fails or a measured value changes noticeably, a notification is sent.

MPN

manufacturer part number

The part number a manufacturer gives a product. Together with the GTIN and brand, it helps to identify a product unambiguously, for example in search engines.

MTA-STS

Mail Transfer Agent Strict Transport Security

A rule with which a domain specifies that other mail servers may only deliver emails to it encrypted and with a valid certificate. This prevents the encryption from being switched off unnoticed on the way.

MTTD

Mean Time to Detect

The average time from the start of a fault until it is detected. Good monitoring shortens it; it is followed by the time to repair (MTTR).

MTTR

Mean Time to Repair

The average time from detecting a disruption to fixing it. Depending on the source, the R also stands for resolve or recovery; it always means the time until normal operation is restored.

MTU

maximum transmission unit

The largest amount of data a network can carry in a single packet, usually 1500 bytes on Ethernet. Larger packets have to be split; if firewalls block this, connections break off.

MUK

Mein Unternehmenskonto (My Company Account)

Mein Unternehmenskonto (My Company Account): the central account companies use to sign in to German government portals, for example at the BSI to register under NIS2. It is based on the company's ELSTER certificate.

MX

Mail Exchanger

A DNS record that defines which server accepts the emails for a domain.

Name server

A server that holds the DNS records of a domain and gives the authoritative answer to queries about them. Which name servers are responsible for a domain is stored at the registry.

NAS

network-attached storage

A storage device in your own network that several computers access together, for example for files and backups. Many of these devices come with their own web interface.

NAT

Network Address Translation

A method in which a router translates the private addresses of many devices into one shared public IP address. From outside, only this one address is visible, not the individual device.

NAT64

Network Address Translation from IPv6 to IPv4

A method that lets devices in an IPv6-only network reach services that are only available over IPv4. A translator between the two networks converts the packets; DNS64 supplies the matching addresses.

NCSC

National Cyber Security Centre

In the UK, the national authority for cyber security, comparable to the BSI in Germany. It publishes guidance, for example on securing email. Bodies with the same abbreviation also exist in other countries, for example Switzerland and the Netherlands.

NDJSON

Newline Delimited JSON

Another name for JSON Lines (JSONL): a text format in which each line is a separate JSON object. This allows data to be transferred and read piece by piece.

NIR

National Internet Registry

A national registry for IP addresses and AS numbers that works below a regional registry (RIR), for example in Japan or Brazil.

NIS2

Network and Information Security Directive 2

EU directive on cybersecurity. It obliges certain companies and organisations to take protective measures and to report security incidents. Whether a company is covered depends, among other things, on its sector and size. This explanation does not replace legal advice.

NIS2UmsuCG

NIS-2-Umsetzungs- und Cybersicherheitsstärkungsgesetz (German NIS2 Implementation Act)

The German law implementing the European NIS2 Directive. It widens the range of companies that have obligations regarding IT security and incident reporting. This explanation does not replace legal advice.

NIST

National Institute of Standards and Technology

The US standards institute. Among other things, it publishes standards for encryption, a cybersecurity framework and the vulnerability database NVD.

noindex

An instruction in the head of a page or in an HTTP header with which a page asks search engines not to include it in their search results.

Nonce

A random value that is used only once. In a Content Security Policy it allows individual scripts specifically; in protocols it prevents old messages from being replayed.

NPS

Net Promoter Score

A customer satisfaction metric based on the question how likely someone is to recommend a company, on a scale from 0 to 10. The score ranges from −100 to +100.

NRW

Nordrhein-Westfalen (North Rhine-Westphalia)

Nordrhein-Westfalen (North Rhine-Westphalia): the most populous German federal state. Among other things, the consumer advice centre Verbraucherzentrale NRW warns about known fake shops.

NS

name server record in DNS

A DNS record that states which name servers are responsible for a domain. Whoever changes it determines where all other DNS records of the domain come from.

NSEC3

Next Secure version 3

A DNSSEC record type with which a name server proves that a name does not exist. Unlike the older NSEC, the names are hashed so that the zone cannot simply be listed.

NTIA

National Telecommunications and Information Administration

An agency of the US Department of Commerce for telecommunications and information policy. In 2021 it defined the minimum elements of a software bill of materials (SBOM).

NVD

National Vulnerability Database

The NIST's public database of known vulnerabilities. It adds severity, affected products and references to the CVE entries.

NXDOMAIN

Non-Existent Domain

A DNS server response saying that the requested name does not exist. If such responses pile up for your own domain, a record is often missing.

OAuth

Open Authorization

An open standard with which you give an application access to an account with another service without revealing your password to it. The application receives a time-limited token for this.

OCSP

Online Certificate Status Protocol

A method for asking the issuer of a certificate whether it has been declared invalid early.

OCSP stapling

A method in which the server delivers the certificate authority's answer on the status of its certificate along with it. The browser then does not have to ask itself; this saves time and does not reveal to the authority who is visiting the page.

OHG

offene Handelsgesellschaft (German general partnership)

A German partnership in which all partners have personal and unlimited liability. It is listed in section A of the commercial register (HRA). This explanation does not replace legal advice.

OIDC

OpenID Connect

A sign-in method based on OAuth 2.0: a website lets users sign in through another service such as Google and receives confirmed details about the person from there, for example the email address.

On-Call

Being on call means staying reachable outside working hours and stepping in when there is a disruption.

Onboarding

Introducing new users or customers: the first steps until a product is set up and in use, often with guidance or help.

Open Graph

Details in the head of a page that specify the title, text and image it is shown with when shared on social networks and messengers.

open resolver

A DNS resolver that answers queries from any computer on the internet. Attackers misuse such servers to direct large volumes of data at a victim using forged senders.

OPM

Office of Personnel Management

The human resources agency of the US federal government. Among other things, it publishes the list of federal holidays, for example the date of Thanksgiving.

Opt-in

Explicit agreement or choice given in advance: something only applies once you switch it on yourself, for example by ticking a box for a newsletter. With double opt-in, you also confirm the sign-up through a link in an email. The opposite is opt-out. This explanation does not replace legal advice.

Origin

Where a web page or file comes from in the eyes of the browser: protocol, domain and port together. With a CDN, the term also means the actual server from which the CDN fetches the content.

ORM

object-relational mapping

A software component that maps database tables to objects in program code, so that developers can work with the data without writing their own SQL queries. Examples are Eloquent and Doctrine.

OS

operating system

Operating system: the basic software of a device on which all other programs run, for example Windows, macOS, Linux, Android or iOS.

OV

Organization Validation

The middle validation level for SSL certificates: besides the domain, the certificate authority also checks that the applicant's organisation exists.

OWASP

Open Worldwide Application Security Project

A non-profit project that publishes freely available guidance on the security of web applications. It is best known for the OWASP Top 10 list of the most common risks.

P95

95th percentile

Shorthand for the 95th percentile: 95 out of 100 measurements are below it. P50 is the median; P99 shows the slowest cases even more clearly.

Pageview

A single view of a page, as counted by visitor statistics.

PAngV

Preisangabenverordnung (Price Indication Ordinance)

Preisangabenverordnung, the German Price Indication Ordinance: it governs how prices must be stated to consumers, for example as a total price including VAT and with a unit price. This explanation does not replace legal advice.

Passkey

Login without a password: the device stores a secret key and confirms the login, for example with a fingerprint or PIN. Because a passkey is bound to the address of the genuine site, it does not work on a fake site.

Patch

An update that fixes errors or security vulnerabilities in software. To patch means to install this update.

Payload

The actual content of a message or request, for example the data a webhook sends. In IT security, the malicious code that an attack runs is also called the payload.

PCI DSS

Payment Card Industry Data Security Standard

The security standard of the card companies for everyone who accepts, processes or stores card data, including online shops. Among other things, it requires the scripts on payment pages to be protected and controlled.

PCI SSC

Payment Card Industry Security Standards Council

The body of the major card brands that publishes and maintains the security standards for card payments, above all PCI DSS.

PCRE

Perl Compatible Regular Expressions

A widespread notation for regular expressions, that is, search patterns for text. Many programming languages and tools understand it.

PDF

Portable Document Format

A file format for documents that looks the same on every device, for example for reports, invoices or forms.

penetration test

A commissioned attack attempt on a system to find weaknesses before attackers do. It only takes place with the operator's permission and ends with a report.

Percentile

The value below which a given share of all measurements lies. At the 95th percentile, 95 out of 100 measurements are below it; so it shows how the slowest cases fare.

Permissions-Policy

An HTTP header that specifies which browser features a page and embedded third-party content may use, for example the camera, microphone or location.

PFS

perfect forward secrecy

A property of an encrypted connection: a separate key is negotiated for each session. If the server's key becomes known later, recorded older connections still cannot be decrypted.

PGP

Pretty Good Privacy

A method for encrypting and signing messages and files with a key pair. In a security.txt, the Encryption field often points to a PGP key so that reports arrive encrypted.

Phishing

A fraud attempt with fake emails, messages or websites that are meant to look genuine, in order to obtain passwords, payment details or other confidential information.

PHP

PHP: Hypertext Preprocessor

A programming language that runs on the server and generates pages there. Many CMS and shop systems are written in PHP.

PHP-FPM

PHP FastCGI Process Manager

A service on the web server that distributes PHP requests to a pool of worker processes. When all processes are busy, new requests wait in a queue: response time rises before errors such as 502 or 504 appear.

PII

Personally Identifiable Information

Information that can identify a person, for example name, email address or IP address. The term comes from US law; the GDPR speaks of personal data. This explanation does not replace legal advice.

PIN

personal identification number

A secret sequence of digits used to identify yourself, for example to release a key stored on a device.

Ping

A simple reachability check: one computer sends a short signal to another and measures whether and how quickly the answer comes back.

PKI

Public Key Infrastructure

A system of certificate authorities, certificates and rules that makes it possible to verify digital identities. The padlock symbol in the browser with HTTPS, for example, is based on it.

PKIX

Public-Key Infrastructure (X.509)

The IETF rules for certificates based on the X.509 standard, as used on the internet for HTTPS and email. "PKIX-valid" means the certificate leads through a chain to a recognised certificate authority and has not expired.

Plugin

An extension that adds functions to a piece of software, for example to a shop system or a CMS.

PNG

Portable Network Graphics

An image format that stores without loss of quality and supports transparent areas. It suits graphics and screenshots; for photos, JPEG, WebP or AVIF are usually smaller.

POODLE

Padding Oracle On Downgraded Legacy Encryption

An attack on the outdated SSL 3.0: an attacker forces the connection down to this old version and can then read parts of the encrypted data. Switching off SSL 3.0 protects against it.

POP

point of presence

A location of a network operator or CDN with its own servers, where requests from the surrounding area are answered. A CDN has many such locations so that content sits close to the visitor.

POP3

Post Office Protocol version 3

An older protocol for fetching emails from the server. The mails are usually downloaded and deleted on the server; today IMAP is more common.

POSIX

Portable Operating System Interface

A common standard for Unix-like operating systems such as Linux and macOS. It defines how basic commands, file access and tools such as cron work, so that programs and scripts behave the same on these systems.

Postmortem

A written review after a disruption: what happened, why, what was done and how it can be avoided in future. It looks for causes, not for someone to blame.

PQ

post-quantum

Encryption methods intended to remain secure against future quantum computers. A hybrid PQ key exchange combines such a method with a proven classical one.

PR

pull request

A proposed code change in a version control system such as Git that others review before it is merged. Automated checks on such a proposal are called PR checks.

prerendering

A version of a page generated in advance: it is fully computed before anyone requests it and then delivered immediately or loaded ahead of time in the browser.

Processing on behalf

A service provider processes personal data on behalf of a company and according to its instructions, for example for hosting or web analytics. This requires a data processing agreement (DPA). This explanation does not replace legal advice.

Propagation

The time until a change in DNS takes effect everywhere. Strictly speaking, nothing spreads: resolvers keep handing out their cached old answer until it expires.

Proxy

An intermediary between two computers: requests go to the proxy first, which passes them on. This is used, for example, for protection, for caching or for statistics via your own domain.

pseudonymisation

Replacing names and identifiers with pseudonyms so that data can no longer be attributed to a person without additional information. Unlike anonymous data, pseudonymous data remains personal data. This explanation does not replace legal advice.

PTR

Pointer (reverse DNS record)

A DNS record for reverse lookup: it assigns a name to an IP address. Mail servers often check it before accepting emails.

PV

pageviews

Pageviews: every load of a page counts as one view. In plans, the number of pageviews often limits the scope of the analytics.

PWA

Progressive Web App

A website that behaves like an app: it can be placed on the home screen, partly works without a network and can send notifications.

Q4

fourth quarter

Q1 to Q4 stand for the four quarters of a year: Q1 covers January to March, Q2 April to June, Q3 July to September and Q4 October to December.

QA

quality assurance

Quality assurance: all checks used to find errors before a change reaches users.

QHD

Quad High Definition

A screen resolution of 2560 × 1440 pixels, four times as many pixels as HD.

QR

Quick Response

A two-dimensional code of black and white squares that a smartphone reads with its camera, usually to open a web address.

QUIC

network protocol QUIC, originally Quick UDP Internet Connections

The transport protocol that HTTP/3 is built on. It runs over UDP instead of TCP, sets up connections faster and has encryption built in.

Pronunciation: like "quick"

RAG

retrieval-augmented generation

A method for AI language models: before answering, the system searches a knowledge base for suitable texts and passes them to the model, so that the answer is based on these sources.

RAM

Random Access Memory

The working memory of a computer: fast storage for running programs that is cleared when it is switched off.

ransomware

Malicious software that encrypts or steals data and demands a ransom for its release.

Rate limit

A cap on how many requests are allowed in a period of time. Anyone who exceeds it is slowed down or rejected, often with status code 429. Rate limiting means setting such caps.

RBAC

role-based access control

Assigning permissions through roles: a user or service is given a role such as "reader" or "administrator", and the role determines what they may do.

RC4

Rivest Cipher 4

An old encryption method that is considered insecure and may no longer be used in TLS. If a server still offers it, that indicates an outdated configuration.

RDAP

Registration Data Access Protocol

A way to query the registration data of domains and IP addresses, for example the registrar and expiry date, in a form that programs can read. It replaces the older WHOIS.

RDF

Resource Description Framework

A W3C standard for describing statements about things in machine-readable form, each as a triple of subject, property and value. RDFa embeds such statements directly in HTML as attributes.

RDP

Remote Desktop Protocol

A protocol for remote access to the desktop of a Windows computer, by default on port 3389. RDP access left open to the internet is a common entry point for attackers.

Redirect

An automatic switch from one address to another, for example when a page has moved. The server reports this with a status code such as 301 (permanent) or 302 (temporary).

ReDoS

regular expression denial of service

An attack that takes a service down with an input on which a poorly built regular expression computes for a very long time. Even a short string can keep a processor busy for seconds or minutes.

Referral

A visit that comes via a link on another website rather than from search, advertising or typing in the address. In web analytics, referral is a channel of its own.

Referrer

The address of the page a visitor comes from, for example a search result or a link on another website. The browser sends it along with many requests.

Referrer-Policy

An HTTP header that specifies how much of the current page's address the browser passes on to the next page when a link is clicked. This keeps paths with personal details, for example, from leaking out.

Registrar

A company through which you register and manage a domain, for example a hosting or domain provider. It passes the registration on to the registry of the domain ending.

Registry

An organisation that keeps a central directory: for a domain ending, the directory of its domains, for .de for example DENIC; as a Regional Internet Registry, the allocation of IP addresses and ASNs in a world region. A directory of technical identifiers is also called a registry.

registry lock

A lock placed directly at the registry of a domain: changes to name servers or the holder are only possible after an additional, usually personal confirmation. It protects against domain theft via a hijacked customer account.

Regression

A step backwards after a change: something that worked before is broken, slower or out of place after an update or deployment.

Relaunch

A new edition of an existing website with a new design, technology or structure. If addresses change in the process, every old address needs a redirect.

Render-blocking

A property of files such as stylesheets or scripts that the browser has to wait for before it draws the page. Many of them delay the first visible content.

Rendering

Turning code such as HTML, CSS and JavaScript into the page you see on the screen. This can happen in the browser or beforehand on the server.

Resolver

A service that looks up in DNS which IP address belongs to a name on behalf of browsers and devices, and keeps the answer in its cache for a while. It is usually provided by the internet provider or a public DNS service.

Responsive

Designed so that a page adapts to the screen size, from phone to large monitor, without the need to scroll sideways.

REST

Representational State Transfer

An architectural style for programming interfaces over HTTP: data is available as resources under fixed addresses and is read, created, changed or deleted with the HTTP methods.

RFC

Request for Comments

Published documents that set out the rules of the internet, for example how email or HTTP work. Each has a number, for example RFC 9110 for HTTP.

RGP

Redemption Grace Period

A period after a domain has been deleted during which the previous holder can still get it back, usually for a fee. Only after that does the domain become available again.

RIPE

Réseaux IP Européens

The European community of network operators. Its coordination centre, the RIPE NCC, is the regional registry that allocates IP addresses and AS numbers for Europe, the Middle East and parts of Central Asia.

RIR

Regional Internet Registry

One of the five regional organisations that allocate IP addresses and AS numbers in a world region, for Europe for example the RIPE NCC.

RIS

Routing Information Service

A measurement service of the RIPE NCC: route collectors at internet exchange points record which routes network operators announce via BGP. The data is public and is used to investigate routing problems.

ROA

Route Origin Authorization

A signed record in the RPKI with which the holder of an address range specifies which autonomous system (AS) may announce that range on the internet. Routers can then detect forged routes.

ROAS

Return on Ad Spend

An advertising metric: revenue divided by ad spend. A ROAS of 4 means that each euro spent brought in four euros of revenue.

ROBOT

Return Of Bleichenbacher's Oracle Threat

An attack on TLS servers that still offer RSA key exchange and respond distinguishably to malformed requests. An attacker may then be able to decrypt connections. It was published in 2017.

robots.txt

A text file in the root directory of a website that tells crawlers which areas they should and should not fetch. It is a request, not a protection.

ROI

Return on Investment

Return on investment: the ratio of profit or savings to the cost of a measure. It shows whether an expense pays off.

Rollout

The introduction of a new version or feature. In a gradual rollout, only some of the users get it at first so that errors show up early.

Routing

Choosing the path through a network: the decision about which stations data packets pass on their way to the destination. In a web application, routing also means the mapping of which address shows which page.

RP

relying party

With passkeys and WebAuthn, the website someone signs in to. The RP ID is its domain; a passkey only works for exactly that domain, which is why it helps against phishing.

RPKI

Resource Public Key Infrastructure

A method with which holders of IP addresses record cryptographically which network may announce their addresses on the internet. Routers can use it to detect and discard false routes.

RPO

recovery point objective

How much data loss is acceptable at most after an outage, stated as a period of time: with an RPO of one hour, there must be a backup at least every hour.

RR

resource record

A single record in a DNS zone, for example an A, MX or TXT record. Several records with the same name and type together form an RRset.

RRSIG

Resource Record Signature

A DNSSEC record type that holds the signature for a group of DNS records. A resolver uses it to check that the answer comes unchanged from the owner of the zone.

RSA

Rivest-Shamir-Adleman

A widely used method for encryption and digital signatures with a public and a private key, named after its three inventors. Many SSL certificates use RSA keys.

RSS

Really Simple Syndication

A format in which a website offers new posts as a machine-readable list. A feed reader fetches it regularly and shows what is new without having to visit the site.

RTO

recovery time objective

How long a system may be down at most after an outage before it is running again. The RTO determines how quickly a recovery has to succeed.

RTS

Regulatory Technical Standards

Detailed requirements that the European financial supervisory authorities draft for an EU law and that the European Commission then adopts as a regulation, under DORA for example on reporting deadlines. This explanation does not replace legal advice.

RTT

Round-Trip Time

Round-trip time: the time a packet needs to reach the destination plus the time for the answer to come back. A ping measures it in milliseconds.

RUA

Reporting URI for Aggregate Reports

The field in a DMARC record that says which address receives the daily aggregate reports. They show which servers sent mail in the domain's name and whether SPF and DKIM passed.

RUF

Reporting URI for Failure Reports

The field in a DMARC record that says which address receives individual reports on failed messages. They can contain parts of the message; many large providers do not send them for privacy reasons.

RUM

Real User Monitoring

Measurement with real visitors: a script records in each visitor's browser how fast the page loads and responds. The counterpart to lab measurements and synthetic monitoring.

runbook

A written step-by-step guide for recurring tasks or incidents, for example what to check first in an outage. This allows people to act even if they do not know the system in detail.

Salt

A random value that is added to the data before a hash is formed. As long as the salt stays secret, the original data cannot be worked out from the hash by trial and error; a new salt each day prevents recognition across days.

SameSite

A property of a cookie that specifies whether the browser also sends it with requests from other sites. The values Strict and Lax protect against forged requests; None allows it everywhere.

SAN

Subject Alternative Name

A field in an SSL certificate that lists all domains and subdomains the certificate is valid for.

Sandbox

An isolated area in which code or content runs without being able to access the rest of the system, for example an embedded frame with the sandbox attribute. A test environment for trying things out safely is also called a sandbox. Google's Privacy Sandbox only carries the term in its name: it was a collection of methods for advertising without third-party cookies.

SANS ISC

SANS Internet Storm Center

An observation centre of the SANS Institute that continuously analyses attacks and anomalies on the internet and publishes reports and measurements about them.

SBOM

Software Bill of Materials

The parts list of a piece of software: all included libraries and components with their version. It makes it quick to check whether a newly known vulnerability applies.

SCC

Standard Contractual Clauses

Contract texts issued by the European Commission that allow personal data to be transferred to countries outside the EU when no equivalent level of data protection has been established for that country. This explanation does not replace legal advice.

Schrems II

A 2020 judgment of the Court of Justice of the European Union. It declared the data protection framework then in place for transfers to the USA (Privacy Shield) invalid. Since then, providers have had to check more closely whether personal data is adequately protected in a third country. This explanation does not replace legal advice.

scraping

Automatically extracting content from websites with programs, for example to collect prices, texts or contact details. The programs for this are called scrapers.

Screen reader

A program that reads screen content aloud to blind and visually impaired people or outputs it on a braille display. It depends on pages being marked up properly.

SDK

Software Development Kit

A package of libraries, tools and documentation with which developers integrate a platform or service into their own software.

Security header

HTTP headers with which a website gives the browser security rules, for example on encryption (HSTS), on allowed sources (CSP) or on embedding in other sites.

SEO

Search Engine Optimization

All measures that help a website to be found more easily in search engine results, such as clear titles, fast pages and good content.

SEPA

Single Euro Payments Area

A single payment area for transfers and direct debits in euros, made up of the EU member states and other European countries. Payments there run with an IBAN under the same rules as at home.

SERP

Search Engine Results Page

A search engine's results page with all results, ads and extra elements such as AI answers or map excerpts.

Server

A computer or program that provides services on a network, for example web pages, emails or data. The browser sends a request and the server answers.

Session

The period in which someone uses a website in one go, or a login that stays valid for a while.

SEV

severity

A level describing how severe an incident is, usually with a number: SEV-1 is a complete outage, higher numbers stand for smaller impact. Escalation and response time depend on it.

SFTP

SSH File Transfer Protocol

A method for transferring files over an encrypted SSH connection, usually on port 22. Unlike the older FTP, passwords and data are not sent in plain text.

SHA

Secure Hash Algorithm

A family of hash methods that calculate a fixed-length fingerprint from any data, for example SHA-256. The older SHA-1 is considered insecure.

SIEM

security information and event management

A system that collects and analyses logs and security events from many sources and raises an alarm when something looks suspicious. It is usually run by a security team (SOC).

Significance

A statistical measure of how unlikely it is that a measured difference arose by chance alone. An A/B test only counts as meaningful once its result is significant.

Sitemap

A file listing the pages of a website that helps search engines find all of its content.

Skimming

Stealing payment details. On the web this happens through malicious code in the checkout of a shop (web skimming), originally through devices attached to card readers.

SKU

Stock Keeping Unit

An item number that uniquely identifies a particular version of a product in stock, for example a T-shirt in a particular size and colour.

SLA

Service Level Agreement

An agreement between provider and customer on the promised quality of a service, for example availability as a percentage or response times for disruptions.

SLH-DSA

Stateless Hash-Based Digital Signature Algorithm

A signature method intended to be secure against quantum computers as well, based only on hash functions. The US standards institute NIST specified it in 2024 as FIPS 205.

SLI

Service Level Indicator

A measured value for service quality, for example the share of successful requests or the response time. It is used to check whether a target (SLO) is being met.

SLO

Service Level Objective

A target value for service quality, for example 99.9% availability per month. Unlike an SLA, it is an internal goal that a team aligns its work with.

SME

small and medium-sized enterprises

Small and medium-sized enterprises. The EU sets limits for this on the number of employees and turnover.

SMS

Short Message Service

A short text message to a mobile phone. In monitoring, it serves as an alert channel that arrives even when the recipient has no internet connection.

SMTP

Simple Mail Transfer Protocol

The protocol with which emails are transferred between mail servers and handed over from the mail program to the server.

SNI

Server Name Indication

A TLS extension in which the browser names the desired website already during connection setup. This lets one server run many websites with their own certificates under one IP address.

Snippet

A short excerpt: a small piece of code that is added to a website, or the short preview text of a page in search results.

SOA

Start of Authority

The first record of a DNS zone. It names the responsible name server, a contact address and a serial number from which the other name servers can tell whether the zone has changed.

SOC

security operations centre

A team or department that continuously monitors a company's IT for attacks, checks alerts and steps in when incidents occur.

SOTI

State of the Internet

A report series by the CDN provider Akamai on the state of the internet, for example on attacks on websites and APIs.

SPA

Single-Page Application

A web application that loads a page only once and then swaps content via JavaScript instead of fetching a new page from the server on every click.

SPDX

Software Package Data Exchange

An open format for software bills of materials (SBOM): it describes which components a piece of software consists of, in which version and under which licence. It is standardised as ISO/IEC 5962.

SPF

Sender Policy Framework

A DNS record that defines which servers may send email on behalf of a domain. This helps recipients to recognise forged senders.

Spoofing

Deception about the origin: an attacker forges a sender, for example an email address, an IP address or a phone number, in order to appear trustworthy.

SQL

Structured Query Language

A query language for databases with which data is read, created, changed and deleted. If input is taken into such a query without checking, an SQL injection is possible.

SRE

Site Reliability Engineering

An approach to running websites and services with the methods of software engineering: with measurable reliability targets, automation and the review of every disruption. The specialists who do this are also called SREs.

SRI

Subresource Integrity

Protection for embedded files: the HTML contains a fingerprint of the expected script or stylesheet, and the browser only loads the file if it matches exactly. This exposes a file that has been secretly changed on someone else's server.

SRV

service

A DNS record type that states on which host and port a particular service of a domain can be reached, for example for telephony or chat.

SSAC

Security and Stability Advisory Committee

An ICANN advisory committee on the security and stability of domain names and address allocation. It publishes reports with recommendations, numbered SAC001, SAC002 and so on.

SSE

Server-Sent Events

A method in which a server keeps sending new messages to the browser over an open HTTP connection, for example live values or notifications. Unlike WebSocket, data only flows from the server to the browser.

SSG

Static Site Generation

Generating all pages of a website as finished HTML files at build time. The server then only delivers them, which is fast and robust.

SSH

Secure Shell

An encrypted protocol for logging in to a server over the network and running commands or transferring files there. It replaces older, unencrypted methods such as Telnet.

SSL

Secure Sockets Layer

An older encryption method for connections on the internet. It is considered insecure and has been replaced by TLS; the name lives on, for example, in the term SSL certificate.

SSL certificate

A digital credential that a server uses to identify itself to the browser and that enables the encrypted HTTPS connection. Certificates expire after a set time and have to be renewed in good time. The name comes from the predecessor SSL; today TLS is used.

SSO

Single Sign-On

A login method in which you sign in once and can then use several services without signing in again, for example with a company account.

SSR

Server-Side Rendering

Generating a web page on the server so that the browser receives finished HTML. This makes the first content visible faster and helps search engines.

SSRF

Server-Side Request Forgery

An attack in which a server is made to send requests to addresses chosen by the attacker, for example to internal services that cannot be reached from outside.

Staging

A test version of a website on its own server or address, where changes are checked before they go live.

Standard contractual clauses

Contract texts specified by the EU Commission for transferring personal data to a third country. Agreeing to them unchanged creates one of the possible safeguards under the GDPR. This explanation does not replace legal advice.

STARTTLS

A command with which an initially unencrypted connection, for example between mail servers, is switched to TLS afterwards. If the command is stripped on the way, the connection continues unencrypted; MTA-STS protects against this.

Status page

A public page on which a provider shows whether its services are currently working and informs about disruptions and maintenance.

Structured data

Additional machine-readable information in the code of a page, usually using the schema.org vocabulary. It tells search engines what the content is about, for example a product, an article or a company.

Stylesheet

A file with CSS rules that define how a page looks, for example colours, fonts and spacing. A page usually loads one or more stylesheets.

Subdomain

A name below a domain, for example shop.example.com below example.com.

subdomain takeover

Takeover of a subdomain by others: its DNS record still points to an external service that is no longer set up there. Whoever registers this slot with the service again can serve their own content under the subdomain.

Supply chain

The supply chain of software or a website: all external components and services it depends on, for example libraries, plugins and embedded scripts. In a supply chain attack, one of these components is manipulated in order to hit many users at once.

SVCB

Service Binding

A DNS record that describes how a service can be reached, for example which protocols it supports. For websites there is a variant of it called the HTTPS record.

SVG

Scalable Vector Graphics

An image format for vector graphics such as logos and icons. It describes shapes instead of pixels and therefore stays sharp at any size.

SVG Tiny PS

SVG Tiny Portable/Secure

A restricted form of the SVG image format for brand logos in BIMI: no scripts, no references to external files and no animation, so that mail programs can display the logo safely.

SWID

software identification (tag)

An identifier that describes installed software, for example vendor, name and version. It is standardised as ISO/IEC 19770-2 and serves as a component identifier in software bills of materials.

SYN

synchronize

The first packet when a TCP connection is set up: the computer announces itself to the server, which replies with SYN-ACK. In a SYN flood, attackers send huge numbers of these packets to overload the server.

synthetic monitoring

Monitoring with artificial visits: a checking program calls pages or flows at fixed intervals from measuring locations and reports outages and slow responses, even when nobody is visiting the site.

TBT

Total Blocking Time

A lab metric for responsiveness during loading: the total time in which long script tasks block the browser so that it cannot respond to input.

TCF

Transparency and Consent Framework

A technical framework of the advertising industry with which consent banners pass on a visitor's decision to advertising partners in a uniform format.

TCP

Transmission Control Protocol

The basic rule for reliable transmission on the internet: it sets up a connection and makes sure that data arrives complete and in the right order. Web pages are usually loaded over it.

TDDDG

Telekommunikation-Digitale-Dienste-Datenschutz-Gesetz

A German law that governs, among other things, when a website may store information on a visitor's device or read it from there, for example cookies. As a rule this requires consent unless it is strictly necessary for the requested service. It used to be called TTDSG. This explanation does not replace legal advice.

Third country

A state outside the EU and the European Economic Area. If personal data is transferred there, additional safeguards are needed, for example an adequacy decision or standard contractual clauses. This explanation does not replace legal advice.

Third-party provider

An outside company whose service a website includes, for example for fonts, maps, videos, payments or statistics. Visitor data can be passed to that company in the process.

Timeout

A request is cancelled because the answer did not arrive within a set time.

TLD

top-level domain

The ending of a domain on the far right, for example .de, .com or .shop. Each ending has its own registry.

TLS

Transport Layer Security

An encryption method for connections on the internet, for example between a browser and a website. TLS is the successor of SSL.

TLS-RPT

SMTP TLS Reporting

A DNS record that names an address to which other mail servers send reports about failed encrypted deliveries. This makes problems with MTA-STS or certificates visible.

TLSA

TLS Authentication

A DNS record type that specifies which certificate a server may present. It is the basis of DANE and requires DNSSEC.

TMG

Telemediengesetz (former German Telemedia Act)

A former German law for online services which, among other things, governed the obligation to provide a legal notice (Impressum). It was replaced in 2024 by the Digital Services Act (DDG); older texts still refer to it. This explanation does not replace legal advice.

Token

A string that serves as proof, for example for a login, for access to an API or as protection against forged form requests. An access token should be kept secret. A hardware token, by contrast, is a small device for logging in.

TOTP

Time-based One-Time Password

A method for one-time codes in two-factor login: an app calculates a new code, usually every 30 seconds, from a secret key and the current time.

TR

Technische Richtlinie (technical guideline)

A technical guideline of the BSI, recognisable by a number such as TR-02102 or TR-03108. It describes the state of the art for a topic, for example secure encryption or secure email delivery.

Tracker

A script or service that records how visitors behave on a website, for example page views or clicks.

Tracking

Recording how visitors use a website, for example which pages they open and where they come from. Depending on the method, consent can be required.

TSV

tab-separated values

A text format for tables in which the columns are separated by tab characters, similar to CSV with commas or semicolons.

TTDSG

Telekommunikation-Telemedien-Datenschutz-Gesetz (former German Telecommunications Telemedia Data Protection Act)

The former name of the German law that, among other things, governs when consent is required for cookies and similar technologies. Today it is called TDDDG. This explanation does not replace legal advice.

TTFB

Time to First Byte

The time from sending a request until the first data of the response arrives. A high value often points to a slow server or a slow database.

TTL

Time to Live

The lifetime of an entry in seconds. In the DNS it says how long resolvers may cache an answer; a change is therefore often only visible everywhere once the TTL has expired.

TU

Technische Universität (technical university)

Technische Universität, a technical university: a university focused on engineering and the natural sciences, for example TU Wien or TU Delft.

TV

television

Television. A TV segment or advert often sends a sudden wave of visitors to a website.

TXT

text record

A DNS record type for free text. It is used, for example, to publish SPF and DMARC rules or confirmations by the domain owner.

typosquatting

Registering domains that differ from a well-known address only by a typo. Visitors are lured to fake shops or phishing pages this way.

UDP

User Datagram Protocol

A connectionless transport protocol on the internet: data packets are sent without acknowledgement of receipt. This is fast; it is used, for example, for DNS queries and for QUIC, the basis of HTTP/3.

UDRP

Uniform Domain-Name Dispute-Resolution Policy

ICANN's procedure for disputes over domains with generic endings such as .com: a trademark holder can obtain the transfer or cancellation of an abusively registered domain.

UG

Unternehmergesellschaft (entrepreneurial company)

Unternehmergesellschaft (haftungsbeschränkt), a German entrepreneurial company with limited liability: a form of GmbH that can be founded with share capital from one euro. It must set aside part of its profit every year until it reaches the capital of a regular GmbH. This explanation does not replace legal advice.

UHD

Ultra High Definition

A screen resolution of 3840 × 2160 pixels, usually called 4K in retail.

UI

User Interface

The user interface: everything you see and operate on the screen, for example menus, buttons, forms and displays.

UK

United Kingdom

The United Kingdom: Great Britain and Northern Ireland. Authorities from there, such as the NCSC, often publish recommendations on IT security.

UKlaG

Unterlassungsklagengesetz (Injunctions Act)

Unterlassungsklagengesetz, the German Injunctions Act: under it, consumer protection associations, for example, can sue companies for an injunction if they breach consumer protection rules. This explanation does not replace legal advice.

ULA

unique local address

An IPv6 address for use within your own network, comparable to private IPv4 addresses such as 192.168.x.x. In practice it starts with fd and is not routed on the internet.

ULID

Universally Unique Lexicographically Sortable Identifier

A unique identifier like a UUID that carries a timestamp at the front. ULIDs can therefore be sorted by the time they were created.

UN

United Nations

The United Nations: an intergovernmental organisation to which almost every country in the world belongs. Its six official languages are Arabic, Chinese, English, French, Russian and Spanish.

Uptime

The share of time in which a website is reachable and responds correctly, usually given as a percentage for a period.

Uptime monitoring

Ongoing checks whether a website is reachable and responds correctly. If it goes down, the service sends a notification.

URI

Uniform Resource Identifier

A uniform identifier for a resource, for example a web address. Every URL is a URI; the broader term also covers identifiers such as mailto: or data:.

URL

Uniform Resource Locator

The complete address of a page or file on the internet, for example https://www.example.com/contact.

USA

United States of America

A country in North America. On our pages it is mostly mentioned in connection with data protection, when data goes to providers based there.

USB

Universal Serial Bus

A widespread connector for devices such as memory sticks, keyboards or charging cables.

USD

US dollar

The currency code for the US dollar, the currency of the United States.

User agent

A program that fetches pages for a person, usually the browser. The identifier it sends with every request, for example browser, version and operating system, is also called that; bots have their own identifiers.

USPTO

United States Patent and Trademark Office

The patent and trademark office of the USA. A trademark registered there can, for example, serve as proof for a brand logo in BIMI.

UStG

Umsatzsteuergesetz (German VAT Act)

Umsatzsteuergesetz, the German VAT Act. Section 14 UStG specifies which details an invoice must contain. This explanation does not replace legal advice.

UTC

Coordinated Universal Time

The worldwide reference time without daylight saving time. Central European Time is one hour ahead of it, Central European Summer Time two hours.

UTF-8

8-bit Unicode Transformation Format

The character encoding commonly used on the web today, which can represent every Unicode character, including accented letters and emojis. If the declared encoding is wrong, accented letters appear as garbled characters.

UTM

Urchin Tracking Module

Additions to an address, for example utm_source or utm_campaign, from which visitor statistics can tell which campaign or source a visit came from.

UUID

Universally Unique Identifier

A worldwide unique identifier made of 32 hexadecimal characters that can be generated without a central authority, for example for records or requests.

UWG

Gesetz gegen den unlauteren Wettbewerb (German Act against Unfair Competition)

A German law that prohibits unfair advertising and business practices, for example misleading statements. Competitors and associations can send a formal warning (Abmahnung) for violations. This explanation does not replace legal advice.

UX

User Experience

User experience: how easily, quickly and pleasantly people can use a website or application, from the first impression to the completed goal.

VAPID

Voluntary Application Server Identification

A method for web push: the server that sends notifications identifies itself with its own key pair. It therefore does not need to register with the browser's push service beforehand.

VAT

value added tax

A tax on sales and services that is shown on invoices. Prices for businesses are often stated without it, prices for consumers with it.

VAT ID

VAT identification number

A company's identification number for VAT in trade within the EU; German numbers start with DE. Among other places, it appears in the legal notice and on invoices to businesses in other EU states. This explanation does not replace legal advice.

VDP

vulnerability disclosure programme

A defined way for outsiders to report security vulnerabilities to an organisation, with rules on what is allowed and how to report. Unlike a bug bounty programme, there is usually no reward.

VEX

Vulnerability Exploitability eXchange

A statement about a piece of software saying whether a known vulnerability in one of its components can actually be exploited there. This helps to filter false alarms out of a software bill of materials (SBOM).

VG

Verwaltungsgericht (German administrative court)

Verwaltungsgericht, a German administrative court of first instance for disputes with authorities, for example about orders from a data protection authority. A judgment initially applies to the case decided. This explanation does not replace legal advice.

VHost

virtual host

A setting on a web server that lets one server deliver several websites under different domains. Each domain gets its own section with its own rules.

VIES

VAT Information Exchange System

An EU system for checking whether a VAT identification number from a member state is valid.

Viewport

The visible area of a page in the browser window. On a phone it is much narrower than on a computer; a responsive page adapts to it.

VLAN

Virtual Local Area Network

A logically separate network on the same hardware: devices on one switch are divided into groups that cannot see each other.

VMC

Verified Mark Certificate

A certificate confirming that a logo belongs to a brand. Some mailboxes only show the logo next to the email via BIMI with such a certificate.

VoIP

Voice over IP

Making phone calls over the internet instead of the classic telephone network. The voice is split into data packets.

VPC

virtual private cloud

A separate network of your own within a cloud platform, in which a customer runs their servers and services with their own address ranges.

VPN

Virtual Private Network

An encrypted tunnel over the internet that connects a device to another network as if it were plugged in there directly, for example the company network. The device then appears with the IP address of the VPN.

VPS

Virtual Private Server

A virtual server: a separated part of a physical computer with its own operating system that you manage like your own server.

VSBG

Verbraucherstreitbeilegungsgesetz (German Consumer Dispute Resolution Act)

The German law on dispute resolution between businesses and consumers. Among other things, it governs when a business must state on its website whether it takes part in arbitration. This explanation does not replace legal advice.

Vulnerability

A flaw or gap in software or settings that an attacker can exploit, for example in an outdated plugin.

W3C

World Wide Web Consortium

An international body that develops web standards such as HTML, CSS and the WCAG for accessibility.

WAF

Web Application Firewall

A firewall for websites: it checks the requests to a web application and blocks typical attacks, for example injected database commands or scripts.

WCAG

Web Content Accessibility Guidelines

International guidelines from the W3C for accessible web content. They are divided into the levels A, AA and AAA; websites are usually expected to meet level AA.

Webhook

An automatic message that a service sends to an address set in advance as soon as an event occurs, for example an outage. This lets other programs react straight away.

White-label

A product that one provider makes and another passes on under its own name and logo, for example an agency that sends reports in its own design to its clients.

WHO

World Health Organization

The World Health Organization of the United Nations. Among other things, it publishes figures on how many people live with a disability.

WHOIS

A lookup service for details about a domain or IP address, for example registrar, expiry date and holder, as far as these are published. For many endings it is being replaced by RDAP.

Wi-Fi

A wireless local network through which devices connect to the internet by radio, for example at home or in the office.

Widget

A small embedded element on a website with its own purpose, for example a chat window, a map or a status display.

Wildcard

A placeholder, usually an asterisk, that stands for any name. A wildcard certificate for *.example.com, for example, is valid for all subdomains on one level.

WIPO

World Intellectual Property Organization

The United Nations organisation for intellectual property such as trademarks and patents. It also decides disputes over domains under the UDRP procedure.

WiStG

Wirtschaftsstrafgesetz 1954 (German Economic Offences Act)

A German law with rules against offences in business, for example against price rules. Through this law, a breach of the Price Indication Ordinance (PAngV) can be punished as an administrative offence with a fine. This explanation does not replace legal advice.

WKO

Wirtschaftskammer Österreich (Austrian Economic Chamber)

Wirtschaftskammer Österreich, the Austrian Economic Chamber: the statutory body representing Austrian businesses. Among other things, it informs its members about new obligations for online shops.

WOFF

Web Open Font Format

A file format for fonts on websites that compresses the font data so that it loads faster. The newer version WOFF2 compresses more and is supported by current browsers.

WOFF2

Web Open Font Format 2

A compressed file format for web fonts. It is smaller than older formats and is supported by all current browsers.

WORM

write once, read many

Storage to which data is written once and can then only be read. Within the retention period it cannot be changed or deleted, which protects backups against ransomware.

WQHD

Wide Quad High Definition

A widescreen resolution of 2560 × 1440 pixels; in everyday use often the same as QHD.

WYSIWYG

what you see is what you get

An editing view in which text already looks while you write it the way it will later appear on the page, similar to a word processor.

XFF

X-Forwarded-For

The X-Forwarded-For header in HTTP requests, in which proxies and load balancers record the sender's IP address. If a service sits behind such intermediaries, it finds the real visitor IP there; the value can, however, be forged.

XFO

X-Frame-Options

Short form of the HTTP header X-Frame-Options. It specifies whether other websites may embed a page in a frame, and so protects against tricked clicks.

XHR

XMLHttpRequest

A browser interface with which a page loads data from the server without reloading. Today the newer fetch is mostly used for this.

XML

Extensible Markup Language

A text format for structured data in which information stands between tags in angle brackets. Sitemaps and RSS feeds, for example, are written in XML.

XSS

Cross-Site Scripting

An attack in which foreign script code is injected into a page and runs in visitors' browsers. It can, for example, read inputs or take over sessions.

YAML

YAML Ain't Markup Language

A text format for configuration and data that uses indentation instead of brackets, which makes it easy to read.

YoY

year over year

Year over year: the change compared with the same period of the previous year, for example May 2026 compared with May 2025.

zero-day

A security vulnerability that attackers already exploit before the vendor knows about it or an update is available. The name means: there were zero days for defence.

ZIP

A file format for compressed archives: several files are combined into one and made smaller in the process.

Zone transfer

The transfer of all records of a DNS zone from one name server to another. If it is allowed for anyone, an outsider can retrieve the complete list of subdomains.

ZSK

Zone Signing Key

The key used in DNSSEC to sign the individual records of a zone. It is changed more often than the higher-level key (KSK) that vouches for it.